Add an account with a setup QR code
- Open the security settings of the service you want to protect and enable an authenticator app or two-factor authentication.
- The service will provide an authenticator setup QR code or secret. Choose scan-to-add in RTAuthenticator and scan that code. Ordinary sign-in codes, payment QR codes, and this website’s download QR code are not authenticator tokens.
- Check the service and account details, save the token, and enter its code back into the service to finish enrollment. Save the recovery codes provided by the service.
Add a secret manually
If scanning is unavailable, use the service’s manual setup secret. In RTAuthenticator’s manual entry, enter the account name, service name, and secret. The type, digit count, algorithm, and period or initial counter must match the service’s instructions. Your normal sign-in password is not the authenticator secret.
TOTP and HOTP explained
- TOTP: time-based
- The code changes automatically at a configured time interval, often 30 seconds. Your device and the service need matching time. Normally, enabling automatic date and time in system settings is sufficient.
- HOTP: counter-based
- The secret and a counter determine the code. Time passing alone does not change it. Generating or advancing a code in the app moves the counter forward. If the app and server counters diverge too far, follow the provider’s resynchronization process.
Use codes and troubleshoot sign-in
Find the correct account, copy its current code, and enter it on the service’s verification page. If a time-based code is about to expire, wait for the next one. Codes are generated locally without a network connection; the website receiving the code still needs connectivity.
- Check that the code belongs to the correct service and account.
- For rejected TOTP codes, check automatic system time and time zone, wait for a new code, and verify the enrollment parameters.
- For rejected HOTP codes, avoid repeatedly generating more codes. Check the counter and use the provider’s sync or re-enrollment instructions.
- Before changing phones or deleting the app, make sure you have a working migration method and provider recovery codes. Existing Google Authenticator users can follow the migration guide.
Protect secrets and setup QR codes: they are the credentials used to generate codes. For support, email rowstop@yeah.net with your device and error details. Do not send secrets, export QR codes, or valid verification codes.