The next time the user goes to login to the website/application, it will prompt not only for username/password, but then also for the time-based 6-digit code. These are usually 6-digit codes that last for 30 seconds.

The user now has an Authenticator app that is enabled with the shared secret to generate Time-based One Time Passwords. Now both the Authenticator app and the website/application that will use two-step login have a shared secret.

The user scans the QR code using their camera with the Authenticator application they downloaded to their phone or tablet. If for some reason the QR code does not work, the authenticator key is often made available as a long text string. The website shares an authenticator key as a QR code.

The user accesses the website or application where they want to add two-step login and initiates that setup process. The sequence for setting up a website to use an Authenticator app for two-step login generally flows like this: These Authenticator applications are typically free for users to download to their phones or tablets from app stores, and include products like Authy, Google Authenticator, Microsoft Authenticator, FreeOTP, Aegis, Duo Security and more. Authenticator applications provide another level of security for two-step login, and generally use a technique called a Time-based One Time Password, or TOTP for short.

Bitwarden 2fa free