iOS 18 Passwords App 2FA Code Generation Explained

Apple's dedicated Passwords app in iOS 18 centralizes credential management by integrating a native authenticator capable of generating time-based one-time passwords (TOTP). This article explains how the Passwords app securely stores shared secrets, computes dynamic verification codes, and integrates with the operating system to automate the two-factor authentication (2FA) workflow without requiring third-party authenticator tools.

The Underlying Algorithm: RFC 6238 Standard

The 2FA feature in iOS 18 relies on the industry-standard Time-Based One-Time Password (TOTP) algorithm defined in RFC 6238. This mathematical standard generates dynamic security codes using two variables:

  1. A Shared Secret Key: A unique alphanumeric key provided by the service you are securing.
  2. The Current Time: A moving time counter derived from the Unix epoch, typically segmented into 30-second intervals (timesteps).

Because both the server (the service provider) and the client (the iOS 18 Passwords app) have access to the exact current time and the shared secret, both independently compute the exact same numeric code at any given moment.

Setup and Key Ingestion

To initialize code generation for an account, the Passwords app must capture the shared secret. In iOS 18, this occurs in one of two ways:

  • QR Code Scanning: The user scans a setup QR code provided by the website or app. This QR code encodes a uniform resource identifier (URI) adhering to the otpauth://totp/ format, which includes the secret key, the issuer name, the account username, the algorithm (typically SHA-1), and the period (usually 30 seconds).
  • Manual Setup Key Entry: If a camera cannot be used, the user inputs the secret key manually into the "Set Up Code..." field within the specific account entry inside the Passwords app.

Cryptographic Generation Process

Once the secret is saved, the Passwords app runs the code calculation locally on the device:

  1. Time Counter Calculation: The system divides the current Unix timestamp by the step duration (usually 30 seconds) to determine the current time step counter.
  2. HMAC Hashing: The system creates a hash-based message authentication code (HMAC) by hashing the time step counter using the shared secret key.
  3. Dynamic Truncation: The resulting hash is truncated dynamically to extract a 4-byte string.
  4. Modulo Operation: A modulo operation is applied to convert those bytes into a readable number, traditionally a 6-digit or 8-digit code.

The code refreshes automatically every 30 seconds as the time window advances. A visual countdown timer inside the app indicates how much validity remains for the active code.

Security and Storage

The shared secrets stored within the Passwords app are safeguarded by the same security infrastructure protecting all system credentials:

  • End-to-End Encryption: Credentials and shared secrets are synchronized across user devices via iCloud Keychain. Apple cannot read this data, as it is encrypted using keys derived from the user's device passcodes and hardware-backed Secure Enclave keys.
  • Biometric Protection: Accessing codes directly within the Passwords app requires Face ID, Touch ID, or device passcode authentication.

Autofill Integration

A major advantage of the native implementation is seamless integration with Safari and system-wide app views. When a login screen detects an input field with the one-time-code autocomplete attribute, iOS 18 automatically queries the Passwords app for the matching account, calculates the valid TOTP code in real time, and suggests it directly above the QuickType keyboard. Tapping the suggestion inputs the code instantly, bypassing the need to open the app, memorize the numbers, or copy and paste.