Apple provided the capability of using TOTP within iOS itself and I noticed there was a section for Use a verification code on a website or in an app which bypasses the QR Code.

My question is whether that the setup key in the setup verification code dialog is the same as the HOTP Secret like the one used in https://www.verifyr.com/en/otp/check#hotp

Asking because the example of that code I've seen seems quite short.

1 Answer 1


The setup key should be the HOTP secret, and the verification code is the TOTP code that you enter as the 2FA value.

The secret in the example is indeed short at 15 characters, whereas a 128-bit secret would contain 26 base32 characters. 128 bits is the minimum recommended secret size in modern cryptography, although unfortunately not all parties use secure cryptography.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .