Using TOTP offline - codes without internet or a phone

The moments you need a second factor are rarely the moments you planned for. You are on a plane, laptop open on the tray table, and the VPN portal wants a code. You are in a basement or a mountain cabin with no signal. Or your phone is at two percent, then none, and the login prompt is still waiting.

None of this touches TOTP. The six-digit code your account wants is not fetched from anywhere: it is computed on the spot by whatever device holds the secret, and that device needs no internet, no signal, and does not have to be a phone.

Here is why, and the realistic ways to get codes without a phone: an installed web app, a hardware token, or paper.

The code was never on the internet to begin with

The time-based one-time password algorithm, RFC 6238, is local arithmetic. At setup, a service hands your device a random shared secret, usually as a QR code. From then on, both sides compute codes from exactly two inputs: the secret and the current time. There is no server call, no push notification, no SMS gateway in the loop. Your device derives the code, and the server checks it by deriving the same value.

The network appears at exactly one place: the login request itself. Signing in means reaching the website, over Wi-Fi, ethernet, or whatever connection exists. The code you type into that page needed none of it. Connection for the conversation, local math for the code — that is the whole distinction.

Airplane mode is not a workaround but normal operation: an app with TOTP entries generates codes indefinitely with its radios off, and the device clock keeps ticking offline. What TOTP is spends almost no time on connectivity, because the algorithm has no network step.

Four offline options, ranked

1. The authenticator app you already have

Any standards-compliant authenticator app generates TOTP codes in airplane mode — iOS, Android, no exceptions. If your second factor lives on your phone, you already own an offline TOTP generator: airplane mode on, codes keep coming.

The catch is the premise of this post: the phone is the component most likely to be dead, lost, or out of reach. Airplane mode solves connectivity, not availability — the rest of this list is for that.

2. An installable web app on your laptop

Next, move the second factor to the machine you log in from. 2FA by DependsiT runs in any modern browser and installs as a PWA — a real app with its own window and icon on iPhone, Android, Windows, and Mac — and once installed it works fully offline.

The guest generator needs no account. Paste a Base32 secret, an otpauth:// URI, a QR code image, or a Google Authenticator export, and codes appear instantly. Everything is computed in the page: 100 percent in-browser, zero network requests, nothing stored, and a reload clears it all.

Add the vault and paste-and-go becomes storage. Entries are encrypted on your device before upload — PBKDF2 salted derivation, HKDF key separation, AES-256-GCM — so the server holds only ciphertext it cannot decrypt, with Argon2id protecting login. Once synced, the vault reads and generates with the network off — the discipline you would expect from an offline password vault, applied to second factors. The features page has the rest: TOTP, HOTP, and Steam Guard, with per-key algorithm, digits, period, and counter.

One caveat survives every web app: the first load needs a connection — the PWA install removes that dependency for good. For the trade-offs of keeping 2FA on the desktop, TOTP authenticators for Windows goes deeper.

3. A hardware OTP token

An OATH hardware token is a keyfob with a screen and a button: it holds your secrets in sealed electronics, shows a six-digit code on demand, and communicates nothing. Battery life is measured in years: Token2's classic model is a 30-second-step keyfob rated at five to seven years, and the vendor's range across models runs three to eight. Many are programmable, so you can load your own secrets and move accounts onto them. Nothing to charge, nothing to update — a TOTP hardware token does one thing, and that is the appeal.

A YubiKey can do this job too, with two clarifications. The behavior most people picture — tap the key, it types a 44-character code — is Yubico OTP, the company's own protocol, not TOTP. TOTP lives in the key's OATH application instead: you enroll credentials through the Yubico Authenticator companion app, and reading a code takes a USB plug or an NFC tap. Storage is finite: Yubico's documentation puts the OATH application at up to 32 credentials, against two slots for Yubico OTP. Best treated as a phishing-resistant primary factor that can also carry a spare set of TOTP codes.

4. The paper backup

The most offline medium is paper. A TOTP secret is a short Base32 string; printed, it is a backup that needs no battery, no OS, and no vendor, and outlives every device in this post. Type it into any generator — an app in airplane mode, the guest tool above — and the codes are back.

This is the KeePass community's long-standing practice: the open-source offline password vault offers to print an emergency sheet when you create a database — master password, file location, and recovery instructions, kept where someone can find it when you cannot act. The pattern extends naturally to TOTP: secrets and recovery codes on a page, in a home safe or a safe-deposit box. Paper does not encrypt; its security is the safe it sits in. Treat the sheet like a key to everything, because that is what it is.

The real risk of offline-only setups

Offline generation is the easy part. Offline-only storage is where people get locked out. A secret that lives on exactly one device — the old phone in the drawer, the single keyfob, the printed sheet nobody can find — is one accident away from losing the account, and recovery without a second factor is slow and never guaranteed.

The discipline is boring and effective:

• Export at enrollment. Save the QR image or the otpauth:// link at setup, and keep it somewhere encrypted, not only on the phone that scanned it.
• Keep a second copy somewhere else. The installed app on your laptop plus the app on your phone; a spare token in a drawer; paper in a safe. Two independent copies in two places is the minimum.
• Print the recovery codes every service shows during 2FA setup. They work with nothing but your password, and they are the designed escape hatch when the authenticator is gone.

A zero-knowledge vault solves the device half: your entries decrypt with your password on any new device, because the keys never lived on the old one. The password half is what paper and recovery codes are for.

TOTP on Linux

Linux users are better covered than the app stores suggest. Linux TOTP tooling starts at the command line: oathtool, from the OATH Toolkit, is packaged for Debian and Ubuntu and produces a code with one line:

oathtool --totp -b 'JBSWY3DPEHPK3PXP'

Mind the shell: a secret typed on the command line lands in your history file. Recent versions of oathtool can read the key from a file or standard input, which keeps it out of the history.

For a TOTP desktop app without a distribution package, the browser route works on any modern distribution: the generator is a web page, nothing to install — no repo, no Flatpak. Chromium-family browsers can install it as a PWA for a permanent offline copy.

Frequently asked questions

Does TOTP work without internet?

Yes. RFC 6238 computes the code from the shared secret and the local clock, so generation works in airplane mode, a dead zone, or a bunker. A connection is needed only for the login request itself. The one offline failure mode is clock drift: a device offline for months with automatic time disabled stops matching the server until its clock resyncs.

What is an OATH token?

OATH stands for the Initiative for Open Authentication, the industry collaboration behind the open HOTP and TOTP standards. An OATH token is any device or app implementing them — in practice, a hardware keyfob with a screen showing 30-second codes. Because the algorithms are open, a secret enrolled on one vendor's token works on any other. Not to be confused with OAuth, the authorization framework; they share letters and nothing else.

Can I print my TOTP secrets?

Yes. The secret is a short Base32 string, and any generator accepts it retyped. Printed secrets plus recovery codes on one sheet, stored in a safe or deposit box, is the most durable backup that exists — no battery, no file format, no vendor. Date the sheet: if a service later rotates its secret, the old printout is quietly wrong. And paper does not encrypt; its protection is the safe, not math.

What happens if my authenticator device dies?

You fall back to the recovery codes you saved at setup, or to the service's account-recovery process — identity checks, waiting periods, no guarantee. Prevention is the whole game: an export of your secrets, a second copy, and the recovery codes printed before you need them. With those, a dead phone or token is a five-minute nuisance instead of a locked account.

Do hardware tokens expire?

The algorithm never expires; the battery does. A dedicated TOTP token runs three to eight years across Token2's models, and when it dies its secrets die with it — which is why you keep the secrets backed up and re-program a replacement. A YubiKey has no battery, drawing power over USB or NFC, but its OATH storage stops at 32 credentials. Whatever the hardware, the enrollment secret is the durable part; tokens are interchangeable consumers of it.

If any of this describes a Tuesday you have already had, try it: open the guest generator, paste a secret, and switch off your Wi-Fi. The code will not notice.