+++
title = "OTP codes"
date = 2026-11-05T00:00:00Z
description = "How HardenedPass stores and shows one-time codes (TOTP) for two-factor login, and how to add them from a QR code or by hand."
weight = 60
draft = false
+++

Many sites offer two-factor login with a code that changes every 30 seconds, the kind
an authenticator app shows. HardenedPass keeps that secret inside the entry, as an
`otpauth://` line:

```
s3cret
otpauth://totp/example.com:carol?secret=JBSWY3DPEHPK3PXP&issuer=example.com
```

Think before you do this. Your password and your second factor end up in the same file,
so whoever opens that entry has both. If you want two truly separate factors, keep the
codes in another app.

## Add a code

Open the entry in the editor, or start a new one. Under the fields:

- **OTP from QR** adds the code from the QR image the site shows you, with **Scan QR
  code** or **Choose an image**.
- **Manual OTP** takes the **Account** and the **Secret** by hand, for sites that also
  show the key as text.

Tap **Save**.

## Read a code

Open the entry. The code appears as a field with a countdown bar, and it refreshes by
itself. The copy icon copies it.

{{< image src="otp.png" alt="An entry showing a password and a six digit OTP code with its countdown." class="max-w-sm mx-auto rounded-lg border border-border" />}}