The six digits change while you are looking at them. The natural question is whether the app is receiving a fresh code from somewhere. A better investigation asks which inputs the local generator uses.
What the Aegis case shows
The REA project’s Aegis study inspects the official Aegis 3.4.3 APK, narrows the package to the generating methods, and connects the generator to display and copy callers. It documents a default 30-second period and six-digit output.
The published interactive example uses public test data and a controllable clock. This article explains that documented case. We have not independently analyzed the APK for this publication.
Time is grouped into a counter
For the documented example, the current time in seconds is divided into 30-second intervals. The account key and interval counter feed the code-generation calculation. Moving within one interval keeps that counter unchanged; crossing the boundary changes it.
The time window is only one input. A clock alone cannot produce an account’s code without the matching secret. Our discussion uses public reference material, never a reader’s real authentication secret.
Why this makes a useful investigation
The visible behavior is precise enough to test. You can select times immediately before and after a boundary, use a known public key, and compare the result with reference vectors. This is a stronger exercise than asking an agent for a general explanation of “how authenticators work.”
APK inspection also creates a useful navigation problem. A package contains many classes. Searching for a name can locate candidates, but references and callers help connect a candidate to the behavior shown in the interface.
A progress-bar class and a code generator can both mention time without playing the same role. The connection matters more than the search result count.
Use a reference to check the explanation
RFC 6238 describes TOTP and supplies test vectors. Use those public vectors when building an educational implementation. A matching screenshot of a six-digit number is a weak check: you need the same algorithm, timestamp, key, output width and encoding.
Be especially careful with seconds versus milliseconds, byte ordering, truncation and leading zeroes. Those are common places for a plausible reconstruction to produce the wrong result.
This is also where source availability helps. Aegis is open source, so its implementation can provide an additional check. That does not remove the need to identify which release artifact your investigation actually inspected.
A useful next exercise
Read the original study’s call chain, then write a compact explanation with an input, transformation and output. Include the assumptions that make a comparison valid. If you implement the public example, test at least one boundary and preserve fixed-width output.
Keep real account secrets out of tutorials and screenshots. The educational result is understanding the calculation; it does not require importing a personal vault.
Continue with checking evidence or browse the official Android documentation for the current prerequisites and tool contracts.