The Google Authenticator implements the one-time passcode as described in RFC 4226, HOTP: An HMAC-Based One-Time Password Algorithm and its extension RFC 6238, TOTP: Time-Based One-Time Password Algorithm.
RFC 6238 specifies the algoritm;
HOTP(K,T) = Truncate(HASH-FUNCTION(K,T))
Where K is the shared secret and T the current Unix time (i.e., the number of seconds elapsed since midnight UTC of January 1, 1970). As for HASH-FUNCTION RFC 6238 describes;
And indeed, i saw several server side implementations with these different HASH-FUNCTIONs. But what about the Google Authenticator App itself? The App defaults with HMAC-SHA-1 (i know this from tests), but can i configure the App towards HMAC-SHA-256 or HMAC-SHA-512? How?
![TOTP implementations MAY use HMAC-SHA-256 or HMAC-SHA-512 functions,
based on SHA-256 or SHA-512 [SHA2] hash functions, instead of the
HMAC-SHA-1 function that has been specified for the HOTP computation
in [RFC4226].](https://i.stack.imgur.com/IDMpW.png)