Security field notes
Useful answers, without the fear.
Clear explanations for choosing, using, and recovering your second factor—written to help you make a safer decision today.
How TOTP works without sending you a message
Understand the shared secret, time counter, HMAC calculation, and why a six-digit code changes every 30 seconds.
TOTP vs SMS: which second factor should you choose?
Compare authenticator codes and text messages across phishing resistance, account recovery, travel, and everyday convenience.
How to store 2FA backup codes without creating a new risk
Build a recovery plan that survives a lost phone while keeping single-use backup codes away from account attackers.
Lost your authenticator? Use this recovery order
A calm, security-conscious sequence for regaining account access without handing credentials to fake support channels.
Passkeys vs TOTP: stronger does not have to mean harder
Learn why passkeys resist phishing, where authenticator codes still help, and how to migrate without losing recovery options.
Why your authenticator code is not working
Diagnose clock drift, wrong secrets, expired windows, account mix-ups, and configuration differences without exposing your setup key.