# What is an authenticator app?

> An app that generates rotating six-digit codes as a second factor, derived from a shared secret and the current time.

Last reviewed: 2026-09-01

## Authenticator app

Category: Authentication

Also called: TOTP app, 2FA app

Canonical page: https://moolkey.com/glossary/authenticator-app

An authenticator app generates a six-digit code that changes every thirty seconds, computed from a secret shared with the site at setup and the current time. Because the code is derived locally and never sent over the network in advance, it cannot be intercepted the way an SMS code can.

### How TOTP works

When you scan the QR code, the site gives your app a shared secret. Both sides then compute HMAC over that secret and the current 30-second time window, truncating the result to six digits. No network traffic is involved at code-generation time, which is why the app works in aeroplane mode.

### Why it beats SMS

SMS codes travel over a network that can be redirected. In a SIM swap, an attacker convinces a carrier to move your number to a new SIM and receives the codes meant for you. Authenticator apps avoid that route because the shared secret stays on your device.

### The backup problem

Losing the phone means losing every code unless you saved the recovery codes at setup. Save them somewhere separate from the phone, and treat that step as part of enabling 2FA rather than an optional extra.

### Sources

- [IETF: RFC 6238: Time-Based One-Time Password Algorithm](https://datatracker.ietf.org/doc/html/rfc6238): The standard that defines rotating time-based authenticator codes.
- [OWASP: Multifactor Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html): A comparison of authentication factors, recovery paths, and common attack routes.
- [NIST: SP 800-63B-4: Authentication and authenticator management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final): Current requirements for passwords, authenticators, recovery, and rate limits.