Glossary

Plain-language definitions for the terms used across this site and inside the app, from TOTP itself to what a "secret" actually is.

2FA (two-factor authentication)

Signing in with two different proofs of identity: usually a password, plus a code from an app like this one. It stops someone who only has your password from getting in.

TOTP (Time-based One-Time Password)

The standard (RFC 6238) most 2FA codes use: a fresh 6-digit code every 30 seconds, calculated from a shared secret and the current time. TOTP Authenticator implements this standard directly. It is the "TOTP" in the name.

HOTP (HMAC-based One-Time Password)

An older, related standard that generates a code from a counter instead of the time. Less common today than TOTP; a handful of legacy services still use it.

Secret (or seed)

The private key a service gives you when you turn on 2FA, usually shown as a QR code or a text string. The TOTP calculation uses it to produce your codes. It never leaves your device unless you back it up or sync it yourself.

otpauth://

The URI format a 2FA QR code encodes (otpauth://totp/Issuer:account?secret=...). Any standards-compliant authenticator app can read it, not just one vendor's.

otpauth-migration://

Google Authenticator's own export format for moving several accounts at once in a single QR code. TOTP Authenticator recognizes it automatically when you scan it with Add → Scan QR.

Issuer

The name of the service an account belongs to (for example "Acme" or "GitHub"). It sits next to the code, so accounts with the same username stay easy to tell apart.

QR export / transfer

Moving one account by showing its QR code on the old device and scanning it on the new one. Free and manual, one account at a time. See /docs/new-phone.

Offline backup

A file containing your accounts that you save yourself, either to a custom folder or shared to another app. It is free, and the file is yours to keep. See /docs/backup-and-restore.

Cloud Sync

The paid, automatic alternative to a manual backup file: an encrypted copy of your accounts kept in your own iCloud (iOS) or Google Drive (Android) account, updated automatically as you add or change accounts.

Recovery

Regaining access to your accounts after losing the device they were on. A backup file, Cloud Sync, or the original device all work. Without one of those, the app cannot recover a secret it never had a copy of. See /docs/troubleshooting/lost-phone-no-backup.

Clock drift

When a device's clock is out of sync with real time. Because TOTP codes are calculated from the current time, drift causes correct-looking codes to be rejected. The fix is turning on automatic date & time, not re-adding the account.

Related: Getting started · Security · FAQ