How Google Authenticator Works Offline

Internet off. Flight mode on. Still a new code every 30 seconds. Where does it come from? Nobody sends it. Google Authenticator: 100 million+ downloads

These 6 digits are your second key And at the end: the one mistake that breaks every code So how, without internet? Two things.

One: a secret, given to you once Remember the QR code you scanned at setup? Inside it: a long secret key One copy to your phone, the same copy

to the server After that, they never talk again Two: time, which both of them have Computers count seconds since 1 Jan 1970 Divide by 30,

and you get a counter It ticks up every 30 seconds, on both sides The trick: secret + counter go into a blender Out comes a jumble of 40 characters

Turning it back into the secret: nearly impossible 4 bytes are picked, making one big number Its last 6 digits: that's your code Now listen:

the server does the same math Same secret, same counter, same code You type it. They match. You're in. The code was never sent;

both made it So no internet needed, even in flight mode New counter after 30 seconds: a whole new code Stolen? It's useless in 30 seconds Now the mistake: what if your phone's time

is wrong? Counters out of step, codes don't match The server allows a step or two, no more The fix: keep your phone's time

on automatic Since April 2023: secrets can back up to your Google account Lost your phone? Codes come back on the new one But at launch,

it wasn't end-to-end encrypted A secret, a clock, a little math SMS OTP or authenticator? Tell me below