Add TOTP Two-Factor to Your Own App: A Developer Guide
A framework-agnostic guide to adding RFC 6238 TOTP two-factor auth: generate a secret, build the otpauth URI, verify codes with a drift window, and stop replay.
Read more →Articles tagged “RFC-6238”
All articles about RFC-6238: 5 practical guides and tutorials from our free, privacy-first online tools.
Anatomy of a 2FA QR Code: The otpauth:// Key URI Explained
Dissect the otpauth:// Key URI a 2FA QR code carries: scheme, totp host, issuer:account label, and the secret, algorithm, digits, and period parameters.
Read more →
How TOTP Authentication Works: RFC 6238 End to End
How TOTP two-factor codes work: the shared base32 secret, time steps, HMAC, RFC 4226 dynamic truncation, and the drift windows servers use to verify.
Read more →
When Services Use SHA-256 or 8-Digit TOTP
RFC 6238 defaults to SHA-1, 6 digits, 30 seconds. Learn what happens when a service picks SHA-256 or 8-digit codes and why some apps generate wrong codes.
Read more →
Why My 2FA Code Is Not Working: A Troubleshooting Guide
Your TOTP code rejected? The fixes ordered by likelihood: clock skew first, then wrong algorithm, digits, period, mistyped secret, and reused codes.
Read more →