ToolypetMCP
intermediate4 minutessecurity

TOTP Implementation Audit

Audit TOTP 2FA implementation: verify secret generation, code validation, and backup code handling.

totp2faauditauthenticationcompliance

इस रेसिपी का उपयोग कब करें

Verify your 2FA implementation follows best practices. Test standard and enhanced TOTP configs, ensure backup codes are properly generated and stored.

चरण

1

Generate standard TOTP

प्रॉम्प्ट:Generate TOTP with SHA-1, 6 digits, 30-second period — the standard Google Authenticator config
2

Generate enhanced TOTP

प्रॉम्प्ट:Generate TOTP with SHA-256, 8 digits, 60-second period — enhanced security variant
3

Create backup codes

प्रॉम्प्ट:Generate 10 backup recovery codes (12 characters each, alphanumeric uppercase)
4

Secure backup code storage

प्रॉम्प्ट:Hash each backup code with bcrypt for secure database storage

अक्सर पूछे जाने वाले प्रश्न

SHA-1 vs SHA-256 for TOTP — does it matter?

SHA-1 is the standard (RFC 6238) and compatible with all authenticator apps. SHA-256 is more secure but not universally supported. Stick with SHA-1 for compatibility.

How many backup codes should I provide?

8-10 single-use codes. Store hashes only (like passwords). Mark as used after each use. Allow regeneration which invalidates all previous codes.

संबंधित रेसिपी