---
type: concept
title: TOTP
tags: [security, authentication, 2fa, totp, open-standard]
related: [2-factor-authentication, zentraler-nutzeraccount, keepassxc, freeotp]
created: 2026-06-30
updated: 2026-07-01
sources: ["output/rz_uni_greifswald_de_dienste_allgemein_zentraler_nutzeraccount_2_faktor_authenti.md", "output/rz_uni_greifswald_de_support_dokumentation_anleitungen_2fa_mit_totp.md", "output/rz_uni_greifswald_de_support_dokumentation_anleitungen_2fa_mit_totp_2fa_vorausse.md"]
---

# TOTP (Time-based One-Time Password)

**TOTP** is an open standard and security mechanism used as a second factor in authentication for generating short-lived, one-time passwords. It is the specific mechanism used for [[2-factor-authentication]] (2FA) for the [[zentraler-nutzeraccount]] at Universität Greifswald.

## Technical Mechanism
TOTP generates a unique, time-synced code that changes at regular intervals based on a shared secret and the current system time. The generation of a TOTP code is strictly dependent on two variables:
1. **TOTP-Secret**: A unique secret key generated by the service being protected and stored securely in the user's TOTP application.
2. **Current Time**: The exact system time of the device generating the code.

### TOTP-Code Characteristics
- **Format**: Typically a 6-digit numeric code.
- **Validity**: Valid for a maximum of 30 seconds.
- **Calculation**: Derived from the combination of the shared secret and the current time interval.

## Technical Dependency: System Time
Accurate system time synchronization is the most critical requirement for TOTP functionality. Because the algorithm uses the current time as a variable, any significant drift between the client device (running the authenticator app) and the authentication server will result in the generation of invalid codes.

### Verification and Troubleshooting
If TOTP codes are not being accepted, the first step is to verify the device's system time. 
- The [[universitatsrechenzentrum-urz]] provides a verification tool at `https://rz.uni-greifswald.de/wobinich/`.
- For Windows 11 users, time synchronization can be forced via **Settings** $\rightarrow$ **Time & Language** $\rightarrow$ **Date & Time** $\rightarrow$ **Sync now**.

## Implementation at Universität Greifswald
The activation of TOTP occurs during the first login to the [[ums]]. The link between the account and the software is established via a **TOTP-Secret**, which can be provided in two forms:
1. **QR Code**: Scanned by apps like **FreeOTP**.
2. **Text Secret**: Manually entered into apps like [[keepassxc]].

The setup is only completed once the user provides a valid generated code to the system for verification.

## Recommended Tools
The university/URZ recommends the following open-source tools for TOTP generation:
- **Desktop**: [[keepassxc]]
- **Mobile**: [[freeotp]]