Overview

TOTP (Time-based One-Time Password) is the authenticator-app second factor a Truestamp user can enable on their account. Once enabled, a password or magic link sign-in adds a second step: you enter the current six-digit code from a standard authenticator app (a fresh code every thirty seconds), and no protected page loads until that step succeeds. You enroll by scanning a QR code and confirming with a current code; to absorb small clock drift, a code from the immediately preceding time step is also accepted. Code entry is rate-limited to 3 attempts per 5-minute window, counted per account, so guessing a short-lived six-digit code is impractical. Passkey sign-ins skip the TOTP step because a passkey is already a strong single-step credential. See two-factor authentication and recovery codes for enrollment, sign-in, and the recovery codes that back up this second factor, and signing in to Truestamp for the surrounding sign-in flow.