TOTP and WebAuthn: how one-time codes and security keys work

In short: TOTP produces a six-digit code every 30 seconds from a shared secret and the time. WebAuthn replaces codes with a key pair that only works on the real site. Both are forms of 2FA.

TOTP (time-based one-time password)

1. At setup the site and the authenticator app share a secret (usually as a QR code).
2. Both compute: secret + current time in 30-second steps → a hash method (HMAC) → six digits.
3. You type the code; the server recomputes and compares (usually allowing one step of drift).

Strengths: works offline, no mobile signal needed. Weakness: the code can be captured on a fake site and replayed at once (Phishing).

WebAuthn / FIDO2 (security keys and passkeys)

1. At setup the device creates a key pair (asymmetric encryption). The public key goes to the site, the private one stays in the device.
2. At sign-in the site sends a random challenge. The device signs it after you confirm with fingerprint, face or PIN.
3. The signature is valid only for the domain the key was created for.

Strengths: on a look-alike site nothing happens because the domain doesn’t match. There is no secret a data breach could leak. This is the basis of Passkeys.

Comparison

	TOTP	WebAuthn
Phishing-proof	no	yes
Offline	yes	yes
Effort	app	key or device
Loss	recovery codes	second key needed

In practice

Use WebAuthn/passkey when possible, otherwise TOTP. SMS codes only as a last resort. Keep recovery codes safe (Password manager).