DEV Community

Muhammad Atif Iqbal
Muhammad Atif Iqbal

Posted on

How Authenticator Apps Generate the Same OTP as Your Server (Without Any Communication)

#authenticatorapps #ai #programming #tutorial

How Authenticator Apps Generate the Same OTP on Authenticator APP as Your Server Without Any Communication between them

One of the most common questions developers ask when learning Multi-Factor Authentication (MFA) is:

How does my server generate the exact same OTP as an authenticator app like Google Authenticator without sending anything to it?

At first, this seems confusing.

You might assume one of these things happens:

  • The server sends the OTP to the authenticator app
  • The authenticator app requests the OTP from the server
  • The server and app somehow communicate in real time

But none of these are true.

The real answer is much more interesting.

The Core Concept

There is no communication between your server and authenticator app during login.

Your server does NOT send OTP to the authenticator app.

Your authenticator app does NOT ask your server for OTP.

Instead, both generate the same OTP independently using mathematics.

This system is called:

Time-Based One-Time Password (TOTP)

It is commonly implemented using libraries such as:

  • PyOTP (Python)
  • Speakeasy (Node.js)
  • OTPAuth

The Real Mechanism

Both your server and authenticator app generate the same OTP because they both have the same three things:

1. The Same Secret

Example:

KZXW6YTBON2GK3TH
Enter fullscreen mode Exit fullscreen mode

This secret is generated by your server when MFA is enabled.

It is then stored:

  • On your server (database)
  • Inside the authenticator app

This shared secret is the foundation of the entire system.

2. The Current Time

Example:

3:24:17 PM
Enter fullscreen mode Exit fullscreen mode

Both the server and authenticator app use the current time.

However, this does NOT mean they calculate OTP every second.

We’ll explain that shortly.

3. The Same Algorithm

Both use the same mathematical algorithm.

Conceptually:

OTP = hash(secret + time_window)
Enter fullscreen mode Exit fullscreen mode

This is not the exact formula, but it helps understand the idea.

Because both systems use:

  • the same secret
  • the same time
  • the same algorithm

they produce the same OTP.

Important: It Does NOT Use Exact Seconds

This is where most confusion happens.

Many people assume OTP is generated using exact timestamps like:

3:24:17
Enter fullscreen mode Exit fullscreen mode

or

3:24:18
Enter fullscreen mode Exit fullscreen mode

If that were true, OTP would change every second.

That would make MFA nearly impossible to use.

Instead, TOTP uses time windows.

Time Windows

Most authenticator systems use:

30-second windows

This means time is divided into 30-second blocks.

Example:

Time Window 1 

3:24:00 → 3:24:29
Enter fullscreen mode Exit fullscreen mode

Same OTP for all these seconds.

Time Window 2 

3:24:30 → 3:24:59
Enter fullscreen mode Exit fullscreen mode

A new OTP is generated.

Time Window 3 

3:25:00 → 3:25:29
Enter fullscreen mode Exit fullscreen mode

Another new OTP.

So if you open your authenticator app at:

3:24:05
Enter fullscreen mode Exit fullscreen mode

and again at:

3:24:27
Enter fullscreen mode Exit fullscreen mode

you will see the exact same OTP.

Because both times fall within the same 30-second window.

Your Exact Scenario

Suppose you try logging in at:

3:23:52 PM
Enter fullscreen mode Exit fullscreen mode

Your server verifies your password and asks for MFA.

You then pick up your phone and open your authenticator app at:

3:24:04 PM
Enter fullscreen mode Exit fullscreen mode

Will it still work?

The answer depends on the time window.

Case 1: Still Within Acceptable Window

If both are effectively verified within the same accepted 30-second range, then:

Server generates:

483921
Enter fullscreen mode Exit fullscreen mode

Authenticator generates:

483921
Enter fullscreen mode Exit fullscreen mode

Login succeeds.

Case 2: Time Window Changed

Suppose you wait until:

3:24:31 PM
Enter fullscreen mode Exit fullscreen mode

A new time window starts.

Now the OTP becomes:

927441
Enter fullscreen mode Exit fullscreen mode

The previous OTP is no longer valid.

How Systems Handle Delays

Modern MFA systems account for timing differences.

They usually verify against multiple windows.

Typically:

  • Previous window
  • Current window
  • Next window

For example, if current server time is:

3:24:31
Enter fullscreen mode Exit fullscreen mode

the server checks OTPs for:

3:24:00 - 3:24:29
3:24:30 - 3:24:59
3:25:00 - 3:25:29
Enter fullscreen mode Exit fullscreen mode

This handles:

  • Slight typing delay
  • Minor clock mismatch
  • Network latency

This is why MFA remains practical.

The Mathematical Process

Now let’s understand how OTP is actually generated.

Step 1: Convert Time into a Counter

Suppose current Unix timestamp is:

1715077445
Enter fullscreen mode Exit fullscreen mode

Divide by 30:

1715077445 / 30 = 57169248
Enter fullscreen mode Exit fullscreen mode

Take only the integer:

57169248
Enter fullscreen mode Exit fullscreen mode

This becomes the current time counter.

At:

3:24:10
Enter fullscreen mode Exit fullscreen mode

counter might be:

57169248
Enter fullscreen mode Exit fullscreen mode

At:

3:24:22
Enter fullscreen mode Exit fullscreen mode

counter is still:

57169248
Enter fullscreen mode Exit fullscreen mode

So both generate the same OTP.

At:

3:24:31
Enter fullscreen mode Exit fullscreen mode

counter becomes:

57169249
Enter fullscreen mode Exit fullscreen mode

Now OTP changes.

Step 2: Combine Secret + Counter

Example:

KZXW6YTBON2GK3TH + 57169248
Enter fullscreen mode Exit fullscreen mode

Step 3: Apply Cryptographic Hash

The system uses:

HMAC-SHA1

This produces a long encrypted output.

Example:

A82BC9F1E0D...
Enter fullscreen mode Exit fullscreen mode

Step 4: Extract Final 6 Digits

From that output:

483921
Enter fullscreen mode Exit fullscreen mode

This becomes the OTP shown to the user.

Why Both Generate the Same OTP

Because both server and authenticator app use:

  • The same secret
  • The same time counter
  • The same cryptographic algorithm

So they naturally produce the same result.

No communication required.

Real-Life Analogy

Imagine two students.

Both have:

The Same Secret Formula 

(secret × window) mod 1000000
Enter fullscreen mode Exit fullscreen mode

Both look at the same wall clock.

If the current 30-second block is:

48
Enter fullscreen mode Exit fullscreen mode

Both calculate:

(12345 × 48) mod 1000000
Enter fullscreen mode Exit fullscreen mode

Both get:

592184
Enter fullscreen mode Exit fullscreen mode

They never communicate.

They simply used the same formula with the same inputs.

That is exactly how TOTP works.

Why QR Codes Are Used

When a user enables MFA, your server shows a QR code.

The QR code contains the secret.

Example:

otpauth://totp/MyApp:atif@gmail.com?secret=KZXW6YTBON2GK3TH
Enter fullscreen mode Exit fullscreen mode

The authenticator app scans it.

Now the app stores the secret locally.

This is the only time your server and authenticator exchange MFA data.

After this:

No communication is needed.

Why Authenticator Apps Work Offline

Since the app already has:

  • the secret
  • the current device time
  • the algorithm

it can generate OTP offline.

That is why apps like Google Authenticator work even when your phone has:

  • No internet
  • Airplane mode enabled
  • No SIM card

The Biggest Misconception

Many developers think:

❌ The server sends OTP to the authenticator app
❌ The authenticator app asks server for OTP

Neither happens.

The reality is:

Both independently calculate the same OTP using:

OTP = Secret + Time Window + Algorithm
Enter fullscreen mode Exit fullscreen mode

Final Takeaway

The entire MFA mechanism works because your server and authenticator app both share the same secret and use synchronized time windows.

That allows both sides to generate identical OTPs independently.

No API call.

No real-time communication.

Just mathematics.

That is the real mechanism behind authenticator-based MFA.

Top comments (0)