What Is MFA? How TOTP-Based Authentication Works
The concept of MFA (multi-factor authentication) and how TOTP works, and why a one-time code on top of a password matters.
MFA (Multi-Factor Authentication) is a method that requires one or more additional authentication factors on top of a password. Even if a password leaks, login is blocked without the second factor, greatly reducing the risk of account takeover. The second factor most widely used is TOTP.
Why MFA is needed
Passwords are vulnerable to leakage, reuse, and guessing. A password leaked from one service is often used as-is to log in to another. MFA adds "something you have" (an authentication device) to "something you know" (the password), so that even if one password is broken, the account is not immediately taken over.
How TOTP works
TOTP (Time-based One-Time Password) is a time-based one-time password method, standardized as RFC 6238. The server and the authentication app first share a secret key, and then combine this key with the current time to compute a short numeric code. It is usually six digits and changes to a new code roughly every 30 seconds.
Because the server and the app use the same key and the same time, they generate the same code without communicating with each other. The user just enters the code shown in the authentication app. Because the code changes at short intervals, a once-exposed code is hard to abuse for long.
TOTP computes the code inside the device without a network, which differs from receiving a code by text message. A code received by text can be intercepted or delayed as it travels the communication network, but TOTP creates the code from only the key shared by the authentication app and the server, so there is no such path.
Things to note when adopting TOTP
You need to prepare backup codes and a re-registration procedure in case an authentication device is lost. Also, if the server and the device times drift significantly, the code may not match, so time synchronization is important.
AxiPass provides TOTP-based MFA and lets you configure tenant-wide enforcement and per-group enforcement. The overall security model can be reviewed on the security page, and you can start for free to examine the MFA settings yourself.