A Practical Guide to Secure 2FA with TOTP

Why Your Password Isn't Enough Anymore? Passwords get reused, phished, and leaked. It's not a matter of if, it's when. And when it happens, your app pays the price even if you did everything right on your end. The fix? Add a second layer. Something that lives on the user's phone, changes every 30 seconds, and works even without internet. That's TOTP-based 2FA, and by the end of this guide you'll have it fully wired up in your TypeScript app. Let's build it. Disclaimer : This article consists of pieces and excerpts from an educational conversation with Claude Sonnet 4.6 What Even Is TOTP? TOTP stands for Time-based One-Time Password . When a user enables 2FA on your app, your server generates a shared secret . It's basically a random string that both your server and the user's authenticator app know about. Using that secret and the current time, both sides independently calculate the same 6-digit code. The user types it in, you verify it, done. The code refreshes every 30 seconds and is