Have you ever put your phone into airplane mode, opened Google Authenticator, and seen a brand-new six-digit security code appear on the screen?
The strange part is that the code still works when you enter it on a website.
There is no Wi-Fi. There is no mobile data. There is no phone signal. Your phone hasn’t contacted the website, yet the website somehow knows whether the code is correct.
So how does that work?
The answer is surprisingly clever. Google Authenticator uses a technology called TOTP, short for Time-Based One-Time Password. Instead of sending a code from your phone to the internet, both your phone and the website independently calculate the same code using a secret key and the current time.
Let’s break it down.
Your Phone and the Website Share a Secret
When you first enable two-factor authentication on an account, the website usually shows you a QR code. You scan that QR code with Google Authenticator. That QR code contains a secret key that looks something like this:
JBSWY3DPEHPK3PXP
You don’t normally see or type this secret yourself. The Authenticator app stores it, while the website keeps its own copy.
Now both sides have the same secret:
Your phone Website server
│ │
│ Same secret key │
└──────────────┬───────────────┘
│
SECRET KEY
This is the foundation of the entire system. The important thing is that the secret doesn’t have to be sent over the internet every time you log in.
Your Phone Doesn’t Need the Internet
This is the part that surprises most people. Google Authenticator doesn’t need an internet connection to generate a TOTP code.
It needs two main things:
1. The secret key
2. The current time
The app combines these values using a cryptographic algorithm and produces a six-digit number.
For example:
Secret key + Current time
↓
Cryptographic
calculation
↓
482913
Your phone can perform this calculation completely by itself. That’s why Google Authenticator continues generating codes when your phone is in airplane mode.
But How Does the Website Know the Code?
This is the clever part. The website has the same secret key. It also has a clock. When you type your six-digit code into the website, the server performs its own calculation. Imagine your phone calculates:
Secret: JBSWY3DPEHPK3PXP
Time: 11:21:00
↓
TOTP
↓
Code: 482913
At almost the same moment, the server calculates:
Secret: JBSWY3DPEHPK3PXP
Time: 11:21:00
↓
TOTP
↓
Code: 482913
The server doesn’t have to ask your phone:
“What code did you generate?”
It already knows what the code should be.
Both sides independently arrive at the same answer.
Think of It Like Two Identical Machines
Here’s a simple way to understand it. Imagine you and a website each have an identical machine. Both machines contain the same secret number:
SECRET = 123456789
Both machines also receive the same time:
TIME = 11:21:00
You press the button on your machine and it produces:
482913
The website presses the button on its machine and also gets:
482913
You enter 482913.
The website says:
“That’s the number I calculated too.”
Access granted.
There was never a need for your phone to send the generated code directly to the website.
Why Does the Code Change Every 30 Seconds?
TOTP normally divides time into short windows. A common configuration uses 30-second intervals. For example:
11:21:00 → 482913
11:21:30 → 731204
11:22:00 → 194827
11:22:30 → 650391
The exact numbers above are only examples, but the idea is the same. Every time the 30-second window changes, the calculation changes, producing a new code. This is why the code displayed in Google Authenticator constantly changes.
What Happens If You Enter the Code With 2 Seconds Left?
Suppose Google Authenticator shows:
482913
⏳ 2 seconds remaining
The code is normally still valid during that current 30-second window. You don’t have to wait for the next code. But if you wait until the time window changes, Google Authenticator might suddenly show:
731204
The old code may no longer be accepted. That’s why websites generally recommend entering the current code before it expires.
What If Your Phone and the Server Have Slightly Different Times?
This is another important part of the system. Your phone and the website’s server don’t necessarily have clocks that are perfectly synchronized down to the millisecond.
For example:
Phone: 11:21:28
Server: 11:21:30
That’s usually fine.
Websites can allow a small amount of time drift by checking nearby time windows. For example, a server might effectively consider:
Previous window
Current window
Next window
depending on how the service has configured its TOTP verification. This gives users some protection against small clock differences while still keeping the system secure. However, if your phone’s clock is significantly wrong, you can start getting:
“Invalid code.”
That’s why keeping your phone’s date and time set automatically is important.
Does Google Send the Code to Your Phone?
No.
This is an important difference between authenticator apps and SMS-based two-factor authentication.
With SMS 2FA, a server sends a message to your phone:
Website
↓
Internet/mobile network
↓
SMS
↓
Your phone
With an authenticator app, the process is different:
Secret key + Time
↓
Authenticator app
↓
Six-digit code
No SMS is required.
No internet connection is required.
No mobile signal is required.
Google Authenticator vs SMS 2FA
The difference becomes much easier to understand this way:
| Feature | SMS 2FA | Authenticator App |
|---|---|---|
| Needs internet on phone | Usually no | No |
| Needs mobile signal | Yes | No |
| Generates code offline | No | Yes |
| Uses a shared secret | Indirectly | Yes |
| Code changes automatically | Yes | Yes |
| Typical code lifetime | Short | Usually 30 seconds |
Authenticator-based 2FA is therefore particularly useful when you don’t have cellular service or when SMS-based authentication isn’t available.
What Is TOTP Actually Doing?
Behind the scenes, TOTP uses a cryptographic process based on HMAC.
You don’t need to understand the mathematics to use it, but conceptually it looks like this:
SHARED SECRET
+
CURRENT TIME
↓
HMAC calculation
↓
One-time password
↓
482913
The result is converted into the familiar six-digit code.
The same calculation happens on the server.
That’s the magic.
Why Can’t Someone Simply Reuse Your Old Code?
Because the code is temporary.
Imagine you successfully log in using:
482913
Thirty seconds later, your Authenticator might generate:
731204
The old code is no longer the current code.
If an attacker somehow sees the old six-digit number, it generally won’t remain useful for long.
This is one reason TOTP is much stronger than simply using a permanent six-digit PIN.
The Secret Key Is More Important Than the 6-Digit Code
Here’s something many people don’t realize. The six-digit number isn’t the most valuable piece of information. The secret key behind the authenticator is much more important. Think about it like this:
Six-digit code
↓
Temporary
↓
Expires quickly
But:
Secret key
↓
Used to generate codes
↓
Potentially useful for a much longer time
That’s why you should never share an authenticator setup QR code or secret key with someone else. If someone obtains the underlying secret, they may be able to generate valid TOTP codes.
Why Does Airplane Mode Prove This Works?
You can actually demonstrate the basic concept yourself.
Turn on airplane mode.
Then open Google Authenticator.
You’ll still see something like:
Abijita Account
482913
████████░░
Wait around 30 seconds.
The code changes:
731204
██████████
No internet connection was required. Your phone simply used the secret stored inside the app and its local clock to calculate the new value.
What Happens When You Log In?
The complete process looks like this:
STEP 1
You enter your username and password
↓
STEP 2
Website asks for your 2FA code
↓
STEP 3
You open Google Authenticator
↓
STEP 4
Phone calculates the current TOTP code
↓
STEP 5
You enter the 6-digit code
↓
STEP 6
Server calculates its expected code
↓
STEP 7
Codes match?
↓
YES
↓
Login successful
Notice something important. At no point does the server need to contact your phone and ask it for the code. The phone and server are simply doing the same calculation independently.
What If Your Phone Is Completely Offline?
That’s perfectly fine for TOTP.
Your phone can be:
- In airplane mode
- Without a SIM card
- Without Wi-Fi
- Without mobile data
- Without cellular signal
And the Authenticator app can still generate codes.
The requirement is that the phone’s clock is reasonably accurate.
The website itself, of course, still needs an internet connection when you’re actually logging into it.
Is the Code Always Valid for Exactly 30 Seconds?
Not necessarily.
There are two different concepts here:
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Code generation interval: commonly 30 seconds.
Server acceptance window: depends on how the website has configured its TOTP verification.
A website may allow a small amount of clock drift by accepting a code from a nearby time window. For example, if your phone and the server are a few seconds apart, the login can still succeed. So you shouldn’t assume that every website will accept a code for the same amount of time.
The Simple Answer
So, how does Google Authenticator generate a working code without the internet?
Because it doesn’t need to communicate with the website to generate the code. Your phone and the server already share a secret key. They both know the current time. They independently run that information through the same cryptographic process. And they arrive at the same six-digit number.
In simple terms:
PHONE SERVER
│ │
│ Secret key │ Secret key
│ + │ +
│ Current time │ Current time
│ │
└────── Same calculation ──────┘
↓
482913
That’s the clever idea behind TOTP.
Your Authenticator app isn’t receiving the code from the internet. It’s calculating the code itself — and the server is independently calculating the same code.
So the next time you put your phone into airplane mode and see Google Authenticator generating a fresh six-digit number, you’ll know exactly what’s happening behind the scenes.
