How TOTP Authenticator Apps Work Offline

Applications such as Google Authenticator can generate a verification code while the phone is offline. The server and application share a secret established when the QR code is scanned, then independently use that secret, the current time, and the same algorithm to produce a short code that changes periodically.

At login, the user sends the code to the service. The server calculates acceptable codes within a small time window and compares them. No direct connection to the authenticator, Google OAuth, or a Google API is required. Transfer and cloud-sync features are separate from TOTP generation itself.

When implementing this method, encrypt stored secrets, provide single-use recovery codes, allow only limited clock drift, and rate-limit attempts. The recovery process also needs strong protection because it can otherwise become the easiest route around the second factor.