TOTP secrets, QR images, and codes stay in this browser tab. passwords.lu does not receive them. Cloudflare may still record anonymous page views for site reliability (not your secrets).
The service or organisation associated with the account, such as GitHub or Example Bank.
The username or email address shown in the authenticator app.
For new setups, prefer SHA-256 (modern and NIST-aligned). Use SHA-1 when you need maximum interoperability with Google Authenticator, Authy, Apple Passwords, and most hardware tokens. SHA-512 is rarely necessary for typical 6-digit codes.
How often a new code is generated.
A TOTP secret is equivalent to a copy of your authenticator. Anyone who obtains it can generate valid codes.
Generate a secret to see the QR code, otpauth URI, and live TOTP codes.
The problem: Many sites show the setup QR once, then your authenticator never reveals the raw secret again.
The fix: Open Decode first, capture the QR, then print a recovery sheet or store the Base32 offline before you enrol your phone.
The problem: You’re on a laptop, in a phone-free zone, or the QR is only on screen.
The fix: Screenshot → Decode to extract the secret → Test for live codes on the same machine.
The problem: Re-enrolling a physical phone every time you wipe a test database is slow.
The fix: Generate temporary secrets, copy otpauth:// URIs, and exercise t−1 / t+1 in Test — then clear the page.
The problem: The digits look right, but the site keeps rejecting them.
The fix: Paste the secret into Test and enter the phone’s code. A match on t−1 or t+1 usually means the clocks disagree.
The problem: You’re switching authenticators and want to know issuer, algorithm, and secret first.
The fix: Decode works offline for single otpauth://totp QRs. Multi-account Google Authenticator export bundles are detected but not unpacked yet.
TOTP adds useful protection against password reuse and many credential attacks, but it does not reliably stop real-time phishing. Passkeys or hardware security keys provide stronger phishing resistance where available.
Further reading
Use the generator, then go deeper on password strength, passkeys, secure sharing, and account hygiene.