hmac

1 post

TOTP From Scratch — How Your 2FA Code Actually Works A deep dive into RFC 6238 Time-based One-Time Passwords: the math behind the 6-digit code, how HMAC-SHA1 produces it, and a complete Python implementation built without any TOTP library.

April 17, 2026 — 13 min read — 1,848 words

TOTPTWO FACTOR AUTHSECURITYPYTHONCRYPTOGRAPHYHMACRFC 6238