Two-factor authentication (TOTP)

Your tagl includes a built-in vault for two-factor authentication codes — the six-digit codes (TOTP, time-based one-time passwords) that sites ask for after your password. The codes are generated on your device, from secrets stored inside your tagl; the server never sees them.

What it replaces

Normally you keep TOTP secrets in a separate authenticator app (Google Authenticator, Authy, and similar). With Tagl ID, those secrets can live inside your tagl instead:

• One thing to guard instead of two. Your identity and your second factors are in the same file, protected by the same PIN and the same backup discipline.
• Backups actually exist. Classic authenticator apps are notorious for being lost with the phone. Your tagl backups automatically include the TOTP secrets present when the backup was made — if you keep backups at all, your second factors are covered.
• No extra account. There is no cloud sync service holding your secrets; they are in your file, on your devices.

The trade-off, stated honestly

Putting second factors inside the tagl concentrates risk: the tagl becomes a single point holding both your identity and your 2FA secrets.

Three consequences:

1. Backups matter even more. Losing all tagl copies now also means losing your 2FA codes for other sites. Whether those sites offer their own account recovery is up to them, not us. Follow How to store your tagl and consider enabling the encrypted cloud backup there.
2. Back up after every addition. A TOTP secret you add today exists only in copies made after today. Adding a secret and not refreshing your backup is the most common way to lose one.
3. Exposure cuts both ways. If someone obtains your tagl and PIN, both your identity and your stored second factors are at risk — see the compromise steps in the storage guide.

If you prefer to keep your second factors separate from your identity, that is a legitimate choice — the vault is optional.

Adding a secret

When a site offers two-factor authentication, it shows a QR code and a setup key (a base32 string like JBSWY3DPEHPK3PXP). Add the setup key to your tagl's vault: currently the vault accepts the key as text — copy it from the site's "can't scan the code?" option and paste it in. Then enter the current six-digit code on the site to confirm, the same flow as with any authenticator app. From then on, the vault generates the codes.

After adding: make a fresh backup of your tagl.

If codes stop matching

TOTP codes depend on the clock. If a code is rejected, check that your device's time is set automatically — a clock that is off by more than a few tens of seconds produces codes that sites reject.