OTP Management: From Generation to Secure Backup – TOTP Best Practices

One-time passwords (OTPs), especially Time-based One-Time Passwords (TOTP), are a cornerstone of two-factor authentication (2FA). They add a second layer of security beyond your password. However, managing TOTP secrets across devices, backing them up safely, and migrating between authenticators can be tricky. This article dives deep into practical OTP management: generation, secure storage, backup strategies, and common pitfalls.

How TOTP Works

TOTP is defined in RFC 6238. It uses a shared secret key (Base32-encoded) and the current time (typically in 30-second intervals) to generate a 6-8 digit code. The algorithm is:

1. Secret: A random Base32 string (e.g., JBSWY3DPEHPK3PXP).
2. Time step: Current Unix time divided by 30 (or other period).
3. HMAC-SHA1: Compute HMAC-SHA1(secret, time_step).
4. Truncation: Extract 4 bytes from the HMAC result, apply modulo 10^6 to get a 6-digit code.

Both server and authenticator app compute the same code. The server verifies the code within a window (usually ±1 time step) to account for clock drift.

Generating TOTP Codes

To generate TOTP codes, you need the secret key. You can get it in two ways:

• Scanning a QR code: The QR encodes an otpauth:// URI. For example:

  otpauth://totp/Example:alice@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Example&algorithm=SHA1&digits=6&period=30
  

• Manual entry: Type the Base32 secret into your authenticator app.

Most authenticator apps (like Google Authenticator, Microsoft Authenticator, Authy, or open-source ones like Aegis) support both methods.

Secure Storage of Secrets

Your TOTP secrets are as sensitive as your passwords. If an attacker obtains them, they can generate valid 2FA codes indefinitely. Therefore:

• Encrypt at rest: Store secrets in an encrypted database (e.g., SQLCipher).
• Use platform key storage: On Android, use Android Keystore; on iOS, use the Keychain.
• Enable app lock: Require fingerprint, face unlock, or PIN to open the authenticator app.
• Disable screenshots: Set FLAG_SECURE on Android to prevent screen capture.

Backup Strategies

Losing your phone means losing access to all your 2FA accounts unless you have a backup. Here are common backup approaches:

Example: Encrypted Backup with GitHub Gist

Some authenticator apps (like OTP Box) allow syncing to a private GitHub Gist. The backup is encrypted client-side before upload:

1. Encryption: Derive an encryption key from a backup password using PBKDF2-HMAC-SHA256 (600,000 iterations). Encrypt the JSON export with AES-256-GCM.
2. Upload: Push the ciphertext to a private Gist.
3. Restore: Download the Gist, decrypt with the same password, and import into the app.

This ensures only you can read the secrets, even if GitHub is compromised.

Migration Between Authenticators

When switching phones or authenticator apps, you need to transfer your TOTP secrets. Here's a safe workflow:

1. Export from old app: Use the app's export feature (often encrypted JSON or otpauth:// URIs).
2. Transfer securely: Use a local cable, encrypted messaging, or a temporary QR code shown on a trusted device. Avoid cloud storage without encryption.
3. Import into new app: Scan the QR or import the file.
4. Verify: Test a code on the new app before disabling the old one.

⚠️ Security note: Never share your secret keys or export files over unencrypted channels (email, SMS, public cloud). Treat them like passwords.

Common Pitfalls

• Clock drift: If your device's time is off, TOTP codes may fail. Enable automatic time sync.
• Losing backup password: If you encrypt your backup and forget the password, your secrets are unrecoverable.
• Using SMS OTP: SMS is vulnerable to SIM swapping and interception. Prefer TOTP or hardware tokens.
• Not testing restore: Always test your backup by restoring on a secondary device.
• Sharing QR codes: Treat QR codes as secrets; they contain the raw key.

Worked Example: End-to-End TOTP Setup and Backup

Let's walk through a complete scenario using a hypothetical authenticator app (similar to Aegis or OTP Box).

Step 1: Add an Account

Scan a QR code from a service (e.g., Google, GitHub). The app stores the secret in an encrypted database.

Step 2: Create an Encrypted Backup

1. Go to Settings > Backup.
2. Choose "Export to file" and set a strong backup password (e.g., P@ssw0rd!2024).
3. The app exports a JSON file encrypted with AES-256-GCM. Save it to a secure location (e.g., encrypted USB drive).

Step 3: Sync via GitHub Gist (Optional)

1. Generate a GitHub personal access token with gist scope.
2. In the app, enter the token and set the same backup password.
3. Click "Push to Gist". The app encrypts the data client-side and uploads.
4. On another device, enter the token and password, then "Pull from Gist".

Step 4: Restore on a New Phone

1. Install the same authenticator app.
2. Choose "Import from file" and select the encrypted backup file.
3. Enter the backup password. The app decrypts and imports all accounts.
4. Verify a code from one account to confirm success.

FAQ

What if I lose my phone and have no backup?

You will lose access to all 2FA accounts. Most services provide backup codes during initial setup; use those to regain access, then re-enroll with a new authenticator.

Is it safe to store TOTP secrets in the cloud?

Only if encrypted end-to-end before upload. Services like Authy sync with encryption, but you must trust their implementation. Open-source apps with client-side encryption (e.g., OTP Box with GitHub Gist) give you more control.

Can I use the same secret on multiple devices?

Yes. The secret is just a key; multiple authenticators can generate the same codes. However, each device must have the correct time. This is useful for redundancy.

How often should I backup?

After adding any new 2FA account, create a fresh backup. If you use cloud sync, it can be automatic.

What's the difference between TOTP and HOTP?

TOTP uses time as a counter; HOTP uses an event counter. TOTP is more common because codes auto-refresh. HOTP requires manual synchronization after each use.

Try generating and managing TOTP codes with our OTP Generator. It's a handy tool for testing or quick code generation without an app.

Remember: Your 2FA secrets are keys to your digital kingdom. Back them up securely, and never share them.