Overview
PassAgent stores TOTP (Time-based One-Time Password) secrets alongside your password entries. Secrets are encrypted client-side with your vault key — the server never sees plaintext TOTP secrets.Adding 2FA to a vault entry
- Paste secret
- Scan QR code
- Generate new
- Open a vault entry and click Add 2FA
- Paste the base32 secret key or
otpauth://URL provided by the service - The secret is encrypted with your vault key before being stored
- TOTP codes are generated locally in your browser
Code generation
TOTP codes are generated entirely in your browser using the Web Crypto API:- Algorithm: SHA-1 (default), SHA-256, or SHA-512
- Digits: 6 (default) or 8
- Period: 30 seconds (default) or custom
- Countdown: visual timer shows remaining validity
For zero-trust entries, the server returns
410 Gone if you request a TOTP code via the API. This is by design — codes must be generated client-side.Account 2FA
Separately from storing TOTP for your vault entries, you can enable 2FA on your PassAgent account itself:- Navigate to Dashboard > Settings > Security
- Click Enable 2FA
- Scan the QR code with any authenticator app
- Enter the verification code to confirm
- Save your recovery codes in a secure location