> What’s the actual likelihood of seeing the same TOTP code from different apps at different times?

There’s only a million 6 digit TOTP codes, so I reckon you get to 50% odds of collision at ~1200 values.

For those curious on how to find that ~1200 values are needed before a 50% probability of collision, this is a generalized form of the birthday problem [0].

With a calculator [1], we can find the exact amount. plugging in D=10^6 (# of unique codes) with P=0.5 (odds of collision) gives you 1178 values.

[0] https://en.wikipedia.org/wiki/Birthday_problem

[1] https://www.bdayprob.com/

The very rough rule of thumb that I think one should remember is: You get a 50% chance of collision with sqrt(total) samples.

Sqrt(1 000 000) = 1 000, close enough to the exact number you calculated.

More accurately, for 50% it's \sqrt(\ln(4))\sqrt(N) which is \sqrt( ln(4) N ).

That's about 1.17741 times \sqrt(N).

The reasons are explained here: https://news.ycombinator.com/item?id=40886363