I needed authenticator-app 2FA for a project and kept running into the same problem: most tutorials stop at "install a library, call verify() ". The parts that actually decide whether your 2FA is secure — the verification window, rejecting reused codes, rate limiting, recovery — get a sentence or nothing.

So I wrote down how to do it properly, following RFC 4226 (HOTP) and RFC 6238 (TOTP), with complete Node.js and Python code that uses only the standard library and passes the RFC test vectors.

While building it I also made a small browser tool, OTP QR Studio ( source ), that turns a secret into an otpauth:// QR code and then checks the code your authenticator app shows. It's handy for checking your server's codes against a real app. It runs entirely in the browser and makes no network requests.

How it works

The server and the user's app share one secret key.…