Lion Cipher Lab
How TOTP two-factor codes actually work
- Identity & Access Management
- Beginner
- ~30 min
- Free · no account required
Why it matters
Almost every security guide ends with the same instruction: turn on two-factor authentication. For most people that means installing an app that shows a six-digit number which changes on its own, and trusting it. That trust is well placed, but blind trust is fragile — people disable 2FA the moment it is inconvenient because they do not know what it is protecting or how. This lab turns the mystery number into something you can produce with your own hands: a code derived from a secret you share with the server plus the current time, run through the same HMAC an authenticator app uses. Once you…
What you'll learn
- how TOTP works
- shared secrets
- HMAC one-time passwords
- time steps
- oathtool
- enrolling a second factor
- why authenticator apps beat SMS
Steps in this lab
- What the six-digit code is really for
- The three ingredients: a shared secret, the clock, and an HMAC
- Install oathtool, a plain command-line OTP generator
- Generate a TOTP code from a secret, by hand
- Watch it roll — the 30-second time step
- Now do it for real: enrol a second factor on your own account
- Why an app beats SMS, and why the secret must stay secret
- The habit to carry forward