Two-factor codes: how your phone and a website agree on six digits without talking

Real time (Unix seconds)0

Progress through the current 30-second block

Website clock is off by0 s

Your phone

------

The website

------

Website also accepts the block before and after

Secret: the ASCII text 12345678901234567890, the test secret from the RFC. At Unix time 59 the real standard says the code is 287082, and so does this figure.