Questions and answers
What is a TOTP code?
A TOTP (time based one time password) is the 6 digit code your authenticator app shows for two-factor authentication. It is calculated from a secret key and the current time, so it changes every 30 seconds and works without an internet connection.
Where do I find my secret key?
When you turn on two-factor authentication, most services show a QR code and a link such as "Can't scan the code?" that reveals the key as text. It looks like JBSW Y3DP EHPK 3PXP. You can also scan the QR code here, or paste the otpauth:// link it contains.
Is it safe to enter my key here?
Codes are calculated entirely in your browser with the open source otpauth library. The key is not sent to any server and is not saved, so it is gone when you close the page. Still, your secret key is as sensitive as a password: only use it on a device you trust.
Can I import accounts from Google Authenticator?
Yes. In Google Authenticator open Transfer accounts, then Export accounts, and scan the QR code it shows with the camera here. Every time based account in the export is listed and you can pick the one you need.
Why is my code not accepted?
Codes depend on the time, so first check that your device clock is set automatically. If you are close to the end of a period, wait for the next code. Also check the advanced settings: a few services use SHA256, 8 digits or 60 seconds.
Can I open the generator with a key in the link?
Yes, links like /#/KEY or /?key=KEY&digits=6&period=30&algorithm=SHA1 are supported. After the key is loaded it is removed from the address bar. Keep in mind that a link containing your key is as sensitive as the key itself.