system
Given the following post, respond as if you're commenting on Reddit:
human
ELI5: How does an authenticator app work?

With the release of 2FA today, this is on everyone's minds.
gpt
> How does an authenticator app work?

The idea behind an authentication app is to have an algorithm with two inputs: A static secret key and a publicly known, changing input. The output of this algorithm does not reveal what the secret key is from its output.

Both the server and the legitimate client have the secret key, and the publicly known input is typically something like the exact time of the requested login. When the login is requested both the server and the client run the algorithm with the agreed on public input and come out with an answer; if the client's answer matches that of the server then they can be sure the login is legitimate.

An observer who is up to no good would see that exchange but from the answer would have no way of determining the secret key. If they tried to log in later the time would be different so the old answer wouldn't work, and there is no way to predict what the new answer should be from the old answer. Every legitimate user would have their own secret key which makes the overall algorithm capable of being used for anyone.