How Authenticator Apps Work – The Basics

In today’s day and age, it has never been more important to secure your online accounts. Passwords alone are often no longer enough to thwart bad actors from cracking an account or gaining access to your website. It’s for this reason that two-factor authentication (2FA) was invented.

2FA forces users to provide a second form of authentication before they are granted access to their account. This ensures that, even if their password is cracked, a bad actor doesn’t automatically gain access.

Authenticator apps play a vital role in this process, providing a secure, secondary form of authentication in a user-friendly way. In this post, we’ll dive into how authenticator apps work.

What are Authenticator apps, anyway?

Authenticator apps have one primary job – to issue OTPs (One Time Passwords). A one-time password, as the name suggests, is a password that you can only use once. By correctly entering this password, you prove that you have access to the account that the OTP is generated for, providing a secondary form of authentication.

Examples of authenticator apps are Google Authenticator, Authy, and Microsoft Authenticator.

These apps work independently of your internet connection, generating codes based on a shared secret key and the current time. This makes them more secure than SMS-based 2FA, which can be intercepted or vulnerable to SIM-swapping attacks.

Authenticator apps are widely used for personal and professional accounts, supporting services like Google, Facebook, and even corporate platforms. They are easy to set up, often requiring you to scan a QR code provided by the account service, and can support multiple accounts within a single app. Whether you’re protecting your social media, email, or banking apps, an authenticator app is a critical tool in modern cybersecurity.

What’s the difference between TOTP and HOTP?

There are two versions of the One Time Password, called TOTP and HOTP. These two versions work very differently, even though the result is pretty much the same – a 6-digit number.

TOTP and HOTP are two different ways in which an algorithm can generate an OTP. Here’s a breakdown of how they work:

HOTP (Hash-Based One-Time Passwords)

The H in HOTP stands for HMAC, which itself stands for Hash-based Message Authentication Code. Yes, it’s an acronym in an acronym.

HOTP hashes the secret key and a counter value to create an OTP. Both the app and the server calculate the same OTP using a hash function (SHA-1). Once the OTP is used, the counter increases. This process creates a new password that can be used. 

HOTP can have issues when the server and app counters get out of sync, which is why it tends to be used less frequently. However, it does have the benefit of not requiring constant regeneration based on a time interval.

TOTP

The T in TOTP stands for time, which indicates the main difference to HOTP. Instead of using a counter, TOTP uses Unix Time at 30-second intervals, with the rest of the process working similarly to HOTP. As such, TOTP issues a new password every 30 seconds, regardless of whether we use it or not.

Generally speaking, TOTP is considered to be the more secure of the two and is more commonly used today.

How are OTPs only used once?

For HOTP to work, all devices need to have the same counter value. As such, as we previously discussed, to account for minor discrepancies, the HOTP authentication service looks at the immediate past and future values if there is no match with the current value to account for any discrepancies in the counter value that can occur over time. As such, HOTP accepts a range of values rather than just one, which makes it less secure overall.

For TOTP to work, on the other hand, the server and the app must have their clocks synchronized. This makes sure that the password matches. The one-time usage of the OTP is due to the fact that OTPs expire after 30 seconds, after which a brand new password is generated.

In reality, the same password may appear more than once since TOTP will technically cycle through all possible numbers in a little bit less than a year (There are 999,999 possible passwords, with each one lasting 30 seconds). However, it is extremely unlikely for this to cause issues given the large number of combinations and the relatively short timeframe in which they can be used.

How to get started with an Authenticator app in WordPress?

To use 2FA on your WordPress site, you’ll need an authenticator app on your phone and a WordPress plugin. In this section, we will cover how to install and use both.

Installing an authenticator app

The authenticator app is a vital part of the process as it provides you with the OTP you need to log in. Our WP 2FA plugin is compatible with any authenticator app that uses TOTP. As such, if you already have an authenticator app installed on your phone, you are good to go.

If you do not currently use an authenticator app, you can easily download and install one for free. There are many great apps to choose from, with common favorites including:

• Google Authenticator (iOS and Android)
• Microsoft Authenticator
• Authy
• Proton Pass

All apps are available for both Android and iOS (Apple) devices. Some apps, such as Proton Pass, also have a computer version that you can install on Windows or Mac computers.

Authenticator apps can be installed just like any other app, with no special procedures required.

Installing and configuring the WordPress 2FA plugin

Now that we’ve installed the authenticator app, we need to install a plugin. Our plugin, WP 2FA, enables you to use various authenticator apps, as well as both HOTP and TOTP.

Step 1: Install the plugin

You can download WP 2FA here. You can add 2FA to your site using both the free or premium version, with the premium version offering extra features like one-click WooCommerce integration and a secondary backup 2FA method.

Step 2: Launch the wizard & select your 2FA method

After installing and activating the plugin, a wizard should pop up. If not, navigate to the new WP 2FA section in the dashboard menu to open the setup wizard.

Click on LET’S GET STARTED! and choose the methods you’d like your users to be able to use. Since we want to use an authenticator app, we’ll select One-time code via 2FA app.

Click on CONTINUE SETUP and then choose whether you’d like your users to use a backup code to log in if they’re unable to use their primary 2FA method.

Lastly, choose which accounts you want to force 2FA on.

Click on ALL DONE and you’re ready to start using 2FA on your site.

All that’s left to do is configure 2FA for your user account.

Step 3: Configuring 2FA and your authenticator app

First, click on CONFIGURE 2FA NOW. In order to configure 2FA, you first need to select the 2FA app option, as seen below:

After moving on to the next step, you will be shown a QR code. All you have to do is download/open the authenticator app of your choice and scan the QR.

After scanning, click I’M READY. Then, all that’s left to do is enter the code provided by your authenticator app to verify it’s set up correctly.

After completing this, you’ll be asked whether you want to generate a list of 2FA backup codes. It’s worth doing so, as this will allow you to get access to the account in case your 2FA method isn’t available.

After doing so, you’re all set!

Can you use the Authenticator app for multiple 2FA accounts?

Yes! Secret keys are an essential part of the equation, as they allow the authenticator app to generate the passwords we need. Multiple keys can be downloaded to one authenticator app, allowing you to use the same authenticator app to log in to different websites. To this end, you can think of the authenticator app as a keyring, with each secret key downloaded to the app being another key in the ring that opens a different door.

Authenticator apps – possibly the best 2FA method

Authenticator apps are one of the most secure forms of 2FA, and they’re also very easy to integrate with most 2FA providers. This includes our own plugin, WP 2FA, for WordPress, but also includes other 2FA tools/integrations on other software.

Hopefully, this post has helped you gain a better understanding of how authenticator apps work and why they play such an important role in keeping you safe online.