Google's free Authenticator made time-based one-time codes the 2FA standard

By 2010, stolen passwords were the default way into accounts, and hardware token systems were expensive and proprietary. The industry group OATH developed a time-based one-time password algorithm so a code could be derived from the current time and a shared secret.

The design meant the server never had to track state: both sides run HMAC on the same time step, so a phone and a website agree on a fresh code every 30 seconds. The IETF published the result as RFC 6238 in May 2011, an open standard anyone could implement.

Google then shipped Google Authenticator as a free app that anyone could enroll codes into by scanning a QR code. Any service could adopt the same open standard, and two-factor authentication became a checkbox rather than a hardware purchase, spreading across banks, social networks and developer tools.

Derive the code from time, so no server state is needed

Time replaces counters, so server and phone stay in sync without state

An open RFC meant no vendor owned the format

Google's free app removed the hardware barrier to adoption

A stolen password alone stopped being enough to break in

Ship the free implementation alongside the open standard, and the standard adopts itself — no sales force required.

TOTP became the default second factor for millions of services and is built into password managers and platform authenticators. Phishing-resistant WebAuthn passkeys have since begun to supersede it, but TOTP remains the baseline two-factor standard.