Authentication & Secrets
TOTP
Also: time-based one-time password, authenticator code
A six-digit code computed from a shared secret and the current 30-second time step.
In more detail
Your authenticator app and the server each compute the code from the same secret and the clock, so no code is ever sent. It proves you hold the secret, which is why the secret itself must be protected. A fake login page can still relay a code within its short life.