Supported Code Types¶
Almost every website uses the same kind of code, and you'll never need this page. It's here for the few that don't, and for Steam.
The usual kind: time-based codes¶
A time-based code (TOTP) is worked out from the account's setup key and the current time, so it changes on a fixed schedule and needs no connection. The settings a website can choose are:
| Setting | What the app accepts | What nearly everyone uses |
|---|---|---|
| Digits | 6, 7, 8, 9 or 10 | 6 |
| Algorithm | SHA-1, SHA-256 or SHA-512 | SHA-1 |
| Refresh interval | 1 to 300 seconds from a QR code or import; 10, 15, 20, 30, 45, 60, 90, 120 or 300 seconds when entering by hand | 30 seconds |
The app calls the everyday combination (6 digits, SHA-1, 30 seconds) TOTP-RFC-6238, after the standard that defines it, and anything else TOTP-RFC-CUSTOM. A QR code sets these for you. When you type a key in, the form starts with the everyday values; only change them if the website tells you to.
Codes are shown grouped for reading: 123 456 for six digits, 1234 5678 for eight, 12 3456 7890 for ten.
Steam Guard¶
Steam's codes are 5 characters (letters and digits), always SHA-1 and 30 seconds. Choose STEAM as the Type when entering the key by hand, and the other settings lock themselves. A Steam account can also come from an otpauth://steam/ QR code or link, or from an Aegis export. See Adding a Steam Account.
Not supported¶
- Counter-based codes (HOTP), which change each time you ask rather than with the clock. Very few services still use them. A QR code for one is refused with a clear message.
- mOTP and Yandex codes.
- Encrypted Aegis exports. Export from Aegis with encryption off.
Which features handle which kind¶
| Time-based (any settings) | Steam | |
|---|---|---|
| Scan a QR code | ✔ | ✔ |
| Enter by hand | ✔ | ✔ (Base32 key or shared_secret) |
| Tap a link | ✔ | ✔ |
| Import from Google Authenticator's format | 6 or 8 digits, 30 seconds only | ✘ |
| Import an Aegis export or a file of links | ✔ | ✔ |
| Backup and restore | ✔ | ✔ |
| Export to Google Authenticator's format | 6 or 8 digits, 30 seconds only | ✘ |
| Apple Watch | ✔ | ✔ |
Continue to Limits and Rules.