No third parties are involved. You get a secret (often presented in the form of a QR code, but most implementations also have it as text) which you store and ge

No third parties are involved. You get a secret (often presented in the form of a QR code, but most implementations also have it as text) which you store and generate short-lived secret messages based on that and the current time, which is the code you enter. The server also knows the secret and can verify you sent the correct message. That's pretty much all there is to it. It's really simple; I once wrote an implementation in Python in 20 lines or so based on just the specification, and I'm not a crypto guy at all. It's probably the simplest crypto systems to implement. Things like "connect your authentication app" make it sound complicated, but all that does is store a short secret in the app. One clear advantage of this is that a code is only valid for a short period of time (usually a few minutes at the most). I can't re-use the code you used yesterday, and intercepting codes is also much harder as it's much more time-sensitive.