Add TOTP Two-Factor to Your Own App: A Developer Guide
A framework-agnostic guide to adding RFC 6238 TOTP two-factor auth: generate a secret, build the otpauth URI, verify codes with a drift window, and stop replay.
Read more →Articles tagged “two-factor-authentication”
All articles about two-factor-authentication: 7 practical guides and tutorials from our free, privacy-first online tools.
Anatomy of a 2FA QR Code: The otpauth:// Key URI Explained
Dissect the otpauth:// Key URI a 2FA QR code carries: scheme, totp host, issuer:account label, and the secret, algorithm, digits, and period parameters.
Read more →
How TOTP Authentication Works: RFC 6238 End to End
How TOTP two-factor codes work: the shared base32 secret, time steps, HMAC, RFC 4226 dynamic truncation, and the drift windows servers use to verify.
Read more →
Lost Phone With 2FA: Every Recovery Option Explained
Lost, stolen or wiped the phone holding your authenticator? Here is how backup codes, cloud sync, saved secrets and account recovery get your 2FA back.
Read more →
Migrate Google Authenticator to Another App: The Reliable Way
Google Authenticator's export QR is a proprietary otpauth-migration blob, not a standard otpauth URI. Learn the reliable re-enrolment route to move accounts.
Read more →
TOTP vs SMS vs Passkeys: A Threat-Model Comparison
Compare SMS codes, TOTP authenticator apps, and passkeys by threat model: SIM swapping, phishing resistance, origin-binding, and when to use each factor.
Read more →
When Services Use SHA-256 or 8-Digit TOTP
RFC 6238 defaults to SHA-1, 6 digits, 30 seconds. Learn what happens when a service picks SHA-256 or 8-digit codes and why some apps generate wrong codes.
Read more →