Add TOTP Two-Factor to Your Own App: A Developer Guide
A framework-agnostic guide to adding RFC 6238 TOTP two-factor auth: generate a secret, build the otpauth URI, verify codes with a drift window, and stop replay.
Read more →Security Tools
Anatomy of a 2FA QR Code: The otpauth:// Key URI Explained
Dissect the otpauth:// Key URI a 2FA QR code carries: scheme, totp host, issuer:account label, and the secret, algorithm, digits, and period parameters.
Read more →
How TOTP Authentication Works: RFC 6238 End to End
How TOTP two-factor codes work: the shared base32 secret, time steps, HMAC, RFC 4226 dynamic truncation, and the drift windows servers use to verify.
Read more →
Lost Phone With 2FA: Every Recovery Option Explained
Lost, stolen or wiped the phone holding your authenticator? Here is how backup codes, cloud sync, saved secrets and account recovery get your 2FA back.
Read more →
Migrate Google Authenticator to Another App: The Reliable Way
Google Authenticator's export QR is a proprietary otpauth-migration blob, not a standard otpauth URI. Learn the reliable re-enrolment route to move accounts.
Read more →
Passphrase vs Random Password: Which Is Harder to Crack?
Passphrase vs random password — which is stronger? Compare entropy, diceware word lists, and cracking cost with hard numbers from NIST SP 800-63B and RFC 2289.
Read more →
Strong Wi-Fi and IoT Device Passwords That Still Type Easily
Generate strong Wi-Fi and IoT device passwords that resist offline cracking yet stay easy to type on phones, smart TVs, and tiny device keypads.
Read more →
TOTP vs SMS vs Passkeys: A Threat-Model Comparison
Compare SMS codes, TOTP authenticator apps, and passkeys by threat model: SIM swapping, phishing resistance, origin-binding, and when to use each factor.
Read more →
When Services Use SHA-256 or 8-Digit TOTP
RFC 6238 defaults to SHA-1, 6 digits, 30 seconds. Learn what happens when a service picks SHA-256 or 8-digit codes and why some apps generate wrong codes.
Read more →
Why My 2FA Code Is Not Working: A Troubleshooting Guide
Your TOTP code rejected? The fixes ordered by likelihood: clock skew first, then wrong algorithm, digits, period, mistyped secret, and reused codes.
Read more →
What Is a Hash? MD5 vs SHA-256 and When to Use Each
A plain-English guide to cryptographic hashes: how MD5, SHA-1, SHA-256 and SHA-512 differ, why MD5 is broken, and when to use each — with practical examples.
Read more →
How to Create Secure Passwords: Length and Entropy
Understand password entropy, why length beats complexity, and how crypto.getRandomValues creates secure passwords aligned with NIST SP 800-63B.
Read more →