One-Time Codes¶
Many websites ask for a second proof that it's you, after your password: a short code that changes every 30 seconds or so. This is called two-step sign-in, or 2FA. Private Passwords makes these codes for you, just as an authenticator app does.
How a code works¶
When you turn on two-step sign-in at a website, it gives you a setup key, usually shown as a QR code. Private Passwords keeps the key, and from it and the time of day it makes a fresh code, the same one the website expects. The key is saved once and never shown again.
Most websites use six digits that change every 30 seconds. Private Passwords also takes the other settings a website may give:
| Setting | Most websites | What Private Passwords takes |
|---|---|---|
| Type | TOTP | TOTP, or Steam Guard's own five-character codes |
| Digits | 6 | 6 to 10 |
| Algorithm | SHA-1 | SHA-1, SHA-256 or SHA-512 |
| Refresh interval | 30 seconds | 1 to 300 seconds |
A code that changes each time you ask for one, rather than with the time (a counter-based code), can't be kept.
A code of its own, or inside a login¶
A code can be kept in either of two ways:
- As an item of its own, made from the built-in One-Time Code template: "A one-time code and nothing else". These items are listed under the Codes type.
- Inside a login, beside its username and password, so that one item holds everything for that website. The built-in Membership template has a place for a code too.
An item holds one code at most.
To give a login a place for a code, edit it, switch to Fields and choose Add TOTP. Back on Values, the place for the code shows the ways to give it one. You may leave it empty and add the code later: the item then has a place for a code, and no code. Remove TOTP takes the code, and its place, away.
When a login that had no code is given one, Authenticator Code is ticked among its MFA for you, and Not Offered is taken off: whether you add the code in its editor, move a code into it, take the other item's code when you merge two items, or have a code kept in a hidden field made its own. If the site doesn't really ask for that code, untick it before you save. Removing the code later leaves the tick for you to take off. See Credential Health.
Each code may have a caption saying whose code it is, for example GitHub · [email protected].
A code kept beside its password is convenient, but anyone who can open that login then has both.
Setting up a code¶
Turn on two-step sign-in at the website, and keep its page open on the QR code. Then give Private Passwords the code in whichever way suits:
- Tap + and choose New One-Time Code. The camera opens: point it at the QR code. If the QR code is on this same iPhone, take a screenshot and tap Choose Photo Instead. If the website gives you a text key, tap Enter Manually Instead.
- In an item's editor, where its code goes: Scan QR Code, Choose a Picture, Paste (a setup link or key you have copied) or Enter the Key.
- Tap a setup link (
otpauth://…) in another app. It opens Private Passwords' editor with the code in it, once you have chosen Private Passwords in the iPhone's Settings, under General → AutoFill & Passwords → Set Up Codes In.
The steps are set out in Setting Up One-Time Codes.
Choose New Item and the One-Time Code template, or edit a login that has a place for a code. Where the code goes:
- Drag the QR code from the web page onto the box that says "Drag the QR code here from the page that shows it".
- If the page won't let go of it, press Control-Shift-Command-4, mark the QR code, then click Paste.
- Paste takes a picture of a QR code, a setup link or a setup key that you have copied.
- Choose a Picture… takes a picture of the QR code from this Mac, such as a screenshot.
- Camera… reads a QR code held up to the Mac's camera, such as one shown on a phone.
- Enter the Key… is for typing the setup key the website shows beside its QR code.
Typing a key: type the setup key, then choose the type, digits, algorithm and refresh interval the website gives you. "Use the settings the service gives you. Most use 6 digits, SHA-1 and 30 seconds." Then choose Use This Key. A setup key is letters A to Z and digits 2 to 7.
Finishing at the website: most websites ask you for a code to finish setting up. As soon as the editor has the key, it shows the code as it is now: type it, or copy it, before you save.
Codes from another authenticator app come in all at once with Import, under One-time codes. See Importing from Another App.
[Screenshot: an item's editor showing a new code and its countdown]
A code is fixed once added¶
Once a code is added, its settings can't be changed: "Fixed when the code was added. To change it, replace the code." If the website gives you a new key, for example after you turn two-step sign-in off and on again, choose Replace Code in the item's editor and give it the new one. The old code stays until a new one is given; Keep the Code It Has leaves it as it was.
Reading and copying a code¶
Open the item. The code is shown large, with three circles above it that empty one after another as its time runs out. In its last five seconds the code flashes and turns amber, then red for the last two, and Next Code shows the code that comes next, so you can read it before it arrives.
Tap the code to copy it: "Tap to copy and close". The item closes, ready for you to paste the code into the website.
Open the item. Its panel shows the code's title, then on the next line whose code it is, then the code itself with its countdown: three circles that empty one after another, and the seconds left. In its last five seconds the code turns amber, then red for the last two, and Next Code under it shows the code that comes next, so you can read it before it arrives.
Click the code to copy it: it stays on the clipboard for 20 seconds. Or drag it into the box where the website asks for it. The i button beside it shows what the code is made by: its type, algorithm, digits and refresh interval.
[Screenshot: a login's code in its last five seconds]
A copied code is cleared from the clipboard after a while. See Copying and the Clipboard for the iPhone or the Mac.
Filling in a code¶
For an item that has a Website, AutoFill can offer its code in a box that asks for one. The page's own codes come first; the others wait behind Show Other Codes. See AutoFill in Safari and Apps.
Drag the code from the item's panel into the page's box for it. When you drag a login's values into a form, its code comes after the other values. See Dragging a Value into a Form.
Moving a code into its login¶
A code kept as an item of its own can be moved into the login it belongs to. Open the code's item: under the code it says "This item is a one-time code on its own. It can be moved into the login it belongs to."
- Choose Move into a Login….
- Pick the login. The logins that look like the code's own are listed first, under Looks like its login, and the rest under Other logins. A login that has a code already isn't listed: an item holds one.
- Private Passwords says exactly what will happen:
- the code and its caption move;
- its other fields that hold a value move too;
- its note is added under the login's note;
- its tags are added to the login's tags;
- its name, website and icon are not kept: the login has its own;
- the code's item is then deleted. This cannot be undone.
- Choose Move and Delete, or Back to pick another login.
On your Apple Watch¶
The iPhone can send your codes to your Apple Watch, to read them on your wrist: see Codes on Your Apple Watch.
Continue to Identities.