Every time you scan a QR code to set up two-factor authentication, your phone starts generating a new 6-digit number every 30 seconds, and somehow the website you're logging into knows exactly what that number should be -- without your phone ever talking to it. That's TOTP (Time-based One-Time Password), and understanding how it works makes it a lot less mysterious, and a lot easier to trust.
The secret is shared once, up front
When you scan that QR code, you're not scanning a code that changes -- you're scanning a static secret key, usually a short string of letters and numbers encoded in Base32. That secret gets stored on your phone (or in your authenticator app) and on the server at the same time. From that point on, neither side needs to communicate again to generate matching codes.
Time is the only other ingredient
TOTP takes that shared secret and combines it with the current time, rounded down to a fixed interval -- almost always 30 seconds. Both your phone and the server independently compute the same value using an HMAC hash of the secret and the time step. Since both sides have synchronized clocks and the same secret, they land on the same 6-digit code without ever exchanging it.
This is why TOTP codes expire so quickly: the time step is baked directly into the calculation. Wait 31 seconds and you're in a new window, which produces a completely different number.
Why this is more secure than SMS codes
SMS-based 2FA has to send a code over a cellular network, which can be intercepted or redirected through SIM-swapping attacks. TOTP never transmits anything at the moment of login -- the code is generated locally on your device using math both sides already agreed on. There's no message to intercept, because there's no message at all.
What happens if your clock drifts
Because the whole scheme depends on both sides agreeing on the current time, a phone with a badly drifted clock will generate codes that don't match the server's expectations. Most implementations tolerate a small amount of drift (checking one window before and after), but if your device's clock is off by more than a minute or two, TOTP logins can start failing even with the correct secret.
Losing the secret means losing the codes
There's no way to recover a TOTP secret after the fact -- if you lose the device or app that stored it and didn't save a backup code, you lose access to that second factor permanently, since the server only stores the secret, not a way to regenerate it from your identity. That's exactly why every service that offers 2FA also gives you backup codes at setup time. Save them somewhere separate from your authenticator app.
Try it yourself
If you want to see the mechanism in action without setting up a real account, the TOTP / 2FA Code Generator takes a Base32 secret and generates the current time-based code from it, the same calculation your authenticator app runs every 30 seconds.