Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I have two-factor authentication enabled on my Google account, and I have this app on my phone which generates a number I have to type when I'm logging in to Google-Mail.

But I don't understand how this number is validated on Google's side. My bank has a similar approach: they gave me this little gadget which also generates numbers.

How do such “authenticator number generators” work?

share|improve this question
Here's a starting place for some research: Time-based One-time Password Algorithm, an extension of HOTP. What level of familiarity do you have with cryptography? That'll largely determine how detailed potential answers need to be. –  Reid Dec 3 '13 at 5:26
add comment

1 Answer

up vote 2 down vote accepted

Google (and other companies) have decided to enable one-time passwords for their 2-factor authentication as a step to improve password security. Here is the webpage that explains what Google is doing in more detail (including source code): https://code.google.com/p/google-authenticator/

In a nutshell, they implement two IETF RFCs, namely RFC 6238 and RFC 4226. Have a look at these two specifications; they contain all the details. I was the shepherd for RFC 6238.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.