Security field notes
Useful answers, without the fear.
Clear explanations for choosing, using, and recovering your second factor—written to help you make a safer decision today.
2FA authentication: a practical guide
Understand 2FA authentication, choose a safer second factor, complete setup without exposing your secret, and preserve recovery options before you need them.
2FA code generator: use it safely
Learn how a 2FA code generator works, which TOTP settings must match your account, and how to use a short-lived code without sharing its secret.
Online TOTP generator: safety checks
Use an online TOTP generator with care: match the service settings, protect the setup secret, and know when a dedicated authenticator is a better fit.
2FA secret key: find and protect it
Find a 2FA secret key during account setup, copy it without errors, and protect it like a password so no one else can generate your codes during sign-in.
otpauth URI: import it accurately
Understand what an otpauth URI contains, import its TOTP settings accurately, and confirm the account label, digits, period, and algorithm before sign-in.
How TOTP works without sending you a message
Understand the shared secret, time counter, HMAC calculation, and why a six-digit code changes every 30 seconds.
TOTP vs SMS: which second factor should you choose?
Compare authenticator codes and text messages across phishing resistance, account recovery, travel, and everyday convenience.
How to store 2FA backup codes without creating a new risk
Build a recovery plan that survives a lost phone while keeping single-use backup codes away from account attackers.
Lost your authenticator? Use this recovery order
A calm, security-conscious sequence for regaining account access without handing credentials to fake support channels.
Passkeys vs TOTP: stronger does not have to mean harder
Learn why passkeys resist phishing, where authenticator codes still help, and how to migrate without losing recovery options.
Why your authenticator code is not working
Diagnose clock drift, wrong secrets, expired windows, account mix-ups, and configuration differences without exposing your setup key.