TOTP (Time-based One-Time Password, RFC 6238) is the second-factor codes generated by an authenticator app like Google Authenticator, Microsoft Authenticator, Authy or any password manager. It's the recommended 2FA method for most users — strong, free, and works offline.
How TOTP Works
The server generates a shared secret at enrolment and displays it as a QR code. The user's authenticator app reads the QR, stores the secret, and from that moment generates a new 6-digit code every 30 seconds based on the secret + current time. The server can compute the same code and verify.
Enrolment Steps
- The user goes to My Account → Security → Two-factor authentication.
- Click Set up authenticator app.
- Scan the displayed QR with their authenticator. Alternatively type the manual key into the app.
- Enter the current 6-digit code shown by the app to confirm the secret was received correctly.
- The platform issues 10 recovery codes — the user should save these somewhere safe.
- TOTP is now active.
What Users Need to Know
- The code is valid for the 30-second window in which it was shown. The server accepts a small skew (typically ±1 step) to handle clock drift.
- If the user's phone is lost, recovery codes get them back in once each. After using all of them they should re-enrol.
- Several authenticator apps (Authy, 1Password) sync the secret across devices, which is more user-friendly but slightly less secure than per-device secrets.
Worked Examples
- New staff onboarding: Day 1 includes TOTP enrolment with the corporate Microsoft Authenticator. Recovery codes are stored in the team password manager.
- Customer self-enrol: A “Set up 2FA” banner appears after the user's first successful sign-in. Step-by-step screenshots in the help guide.
- Lost phone: User uses a recovery code; the system disables TOTP, prompts them to re-enrol with a new device.