About Us

What we do

TOTP Authenticator is a secure, modern two-factor authentication (2FA) code generator. It lets you store the secret keys for all of your online accounts — social media, email, banking, developer tools and more — in one place, and generate the current 6-digit verification code for any of them whenever you need it.

The app follows the RFC 6238 standard for time-based one-time passwords (TOTP), which is the same standard used by Google Authenticator, Microsoft Authenticator and other widely trusted authenticator apps.

Why it exists

Two-factor authentication is one of the most effective ways to protect your accounts, but managing many authenticator entries can become messy. TOTP Authenticator was built to make 2FA management simple, fast and safe — with a clean, mobile-friendly dashboard and strong security practices baked in from day one.

Our security approach

• Encrypted secrets — every TOTP secret key is encrypted with AES-256-GCM using a server-side encryption key before it is written to the database.
• Hashed passwords — account passwords are hashed with bcrypt and are never stored or logged in plain text.
• Server-side decryption — secret keys are only decrypted on the server, for the few milliseconds needed to generate a code.
• Strict authorization — you can only ever view, edit or delete your own accounts. Every request is verified against your secure session.
• Privacy first — no analytics trackers, no third-party scripts scanning your data, and no logging of sensitive information.

Who built it

TOTP Authenticator is developed and maintained by Pabel Islam, as part of the P9X9 family of web tools. Questions, feedback or feature ideas? Reach out via the contact page.