Time-based one-time password
A time-based one-time password (TOTP) is a short-lived authentication code calculated from a shared secret and the current time step, which a verifier can independently check.
An authenticator app can calculate a TOTP code without receiving a text message. The app and verifier have the shared secret and compatible time settings. RFC 6238 recommends a 30-second time step, though that is a recommendation rather than a property of every implementation.
The enrollment secret deserves more protection than a single displayed code. Someone who obtains it may be able to generate future codes. A screenshot of an enrollment QR code can therefore expose more than the code currently on screen.
A changing code can still be phished
Short validity reduces the time available to use a captured code. It does not bind the code to the site where the person entered it. NIST treats manually entered OTPs as non-phishing-resistant because an impostor can relay the output to the real verifier.
“One-time” also requires correct verifier behavior. RFC 6238 requires the verifier to reject a second use after successful validation within that time step. The clock alone does not enforce that rule.
Do not give a code to someone who calls claiming to troubleshoot an account. Unexpected MFA requests covers how to handle an authentication request you did not initiate. The adversary-in-the-middle article explains how a relayed authentication can lead to a usable session even when MFA completed successfully.