Programming Masters
Explained / Authentication
Explained · RFC 6238

What your authenticator app does every 30 seconds

The six digits in Google Authenticator are not random and are not sent to you. Your phone and the server both compute them from a shared secret and the current time. Follow one code from secret to digits.

Runs offlineNo trackingNothing leaves this pageSpec frozen since 2011
More explained