Question 1

What is TOTP and how does it work?

Accepted Answer

TOTP (Time-based One-Time Password) is defined in RFC 6238 and is the standard behind most authenticator apps like Google Authenticator, Authy, and 1Password. It works by combining a shared secret key with the current Unix timestamp divided into 30-second (or 60-second) windows. Both the server and the authenticator app run the same HMAC-SHA1 (or SHA256/SHA512) computation independently, then truncate the result to 6-8 digits. Because they share the same secret and agree on the time window, the codes match without any network communication.

Question 2

What is the otpauth:// URI format used in QR codes?

Accepted Answer

Authenticator apps read QR codes that encode an otpauth:// URI. The format is: otpauth://totp/Issuer:Account?secret=BASE32SECRET&issuer=Issuer&algorithm=SHA1&digits=6&period=30. The secret is Base32-encoded (A-Z and 2-7). When you scan this QR code with any TOTP-compatible app, it registers the account and starts generating matching 6-digit codes automatically.

Question 3

Are these generated TOTP secrets usable in real apps?

Accepted Answer

Yes - the secrets generated here are cryptographically random, properly Base32-encoded, and fully compatible with any RFC 6238 compliant authenticator app. They are intended for testing, development, and QA purposes such as building login flows, testing 2FA enrollment UIs, or populating test accounts. Never use a generated secret for a real production account - always use the secret provided by the actual service you are securing.

Fake 2FA Generator