SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-totp-30-seconds

In TOTP (RFC 6238), what is the default time step for a one-time code?

30 seconds, the RFC's default time-step value.

Start playing free

  1. 5 seconds
  2. 30 seconds ✔
  3. 5 minutes

Why: Authenticator apps compute a new code from the time and a shared secret every time step. The default is 30 seconds. A larger step gives a wider validity window, which is easier for users but easier for attackers too.

Huh, didn't know that: TOTP is an extension of HOTP, the counter-based one-time password algorithm.

The dad joke
My authenticator code and I are alike: we both expire if you take too long to decide.
Like this card?
Play the game

References

Answer: 30 seconds. Authenticator apps compute a new code from the time and a shared secret every time step. The default is 30 seconds. A larger step gives a wider validity window, which is easier for users but easier for attackers too.

  1. IETF RFC 6238, TOTP: Time-Based One-Time Password Algorithm www.rfc-editor.org/rfc/rfc6238
    X represents the time step in seconds (default value X = 30 seconds)
    Checked 2026-10-10.
  2. IETF RFC 6238, TOTP: Time-Based One-Time Password Algorithm www.rfc-editor.org/rfc/rfc6238
    an extension of the One-Time Password (OTP) algorithm, namely the HMAC-based One-Time Password (HOTP) algorithm
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyOn which port do Kerberos servers (KDCs) listen for requests by default?Security & PrivacyYou sign in, and then the system decides which folders you may open. What is that second step?Security & PrivacyCapturing valid login data and sending it again later to impersonate a user is called what?

That's stuff everyone should know.