Two Factor Totp

Tested with the following apps:

• Aegis (open source) Available via F-Droid and Google Play. It features a built-in QR-code reader.
• FreeOTPPlus (open source) Available via F-droid and Google Play.
• OTP Authenticator (open source) Available via F-Droid and Google Play. It features a built-in QR-code reader.
• Google Authenticator (proprietary)
• KeePassXC (Linux, Windows, macOS) (open-source) Available via download, package repositories or GitHub (Keepass also provides a plugin and Keepass2Android allows you to use a TOTP token)
• SailOTP (SailfishOS) (open source) Available via JollaStore or Openrepos.net
• OTP Auth (proprietary) Available via Apple's App Store
• Authy (Twilio Authy) (proprietary) for Android and IOS. Available via Google Play and Apple's App Store

Tested with the following hardware devices:

• Nitrokey Pro
• Nitrokey Storage

Installation

Nextcloud 25 and newer

The app is shipped and comes with the installation of Nextcloud Server. No additional steps are necessary, besides activating it.

Nextcloud 24 and older

The app is available through the app store. It can be installed through Nextcloud's app management UI.

Enabling TOTP 2FA for your account

Admin configuration

Administrators can harden TOTP settings via occ. Changes only affect newly enrolled secrets; existing enrollments continue to work with the algorithm they were created with.

Hash algorithm

The default algorithm is SHA1 as required by RFC 6238. Stricter environments may prefer SHA256 or SHA512, provided all users' authenticator apps support the chosen algorithm.

Value	Algorithm
sha1	SHA1 (default)
sha256	SHA256
sha512	SHA512

occ config:app:set twofactor_totp --type=string algorithm --value=sha256

Secret length

The generated TOTP secret defaults to 32 Base32 characters (160 bits), which meets the recommendation in RFC 4226. Administrators can increase this for higher entropy requirements.

	Characters	Bits
Minimum	26	130
Default	32	160
Maximum	128	640

occ config:app:set twofactor_totp --type=integer secret_length --value=64

Login with external apps

Once you enable OTP with Two Factor Totp, your applications (for example your Android app or your GNOME app) will need to login using device passwords. To manage it, know more here

Development setup

• composer i
• npm ci
• npm run build or npm run dev more info