Time-based authentication apparatus deploys a seed record to user equipment such as a mobile telephone pre-equipped with an app. When a user initiates login access to a protected product or service, using a computing device, they run the app on their mobile equipment which delivers an output such as a QR code (or other local communication such as NFC) containing two time-based codes. The login process on the computing device accepts the output and sends the time-based codes to the authentication apparatus, either together or the second code on request. The authentication apparatus now locates the codes and automatically resynchronises to any time zone across the world plus 1 hour of clock drift (+/− 13 hours UTC).