Five security terms that describe different things

OTP is a category; TOTP and HOTP are methods

OTP means one-time password. It can refer to codes delivered by email or SMS, codes produced by a hardware token, or locally generated authenticator codes. TOTP means time-based one-time password. Its value depends on a shared secret and the current time step. HOTP means HMAC-based one-time password, where an advancing event counter replaces the time step. The two algorithms may display similarly shaped digits, but their counter state and verification behavior differ.

2FASync generates and imports supported TOTP profiles. Its Google Authenticator migration preview identifies HOTP records without converting or importing them. If a service gives you an SMS code, do not paste it as though it were a long-lived authenticator setup key. The SMS value is already the short-lived OTP; a TOTP generator cannot regenerate the next SMS message.

2FA and MFA describe how many factors are used

Two-factor authentication, or 2FA, combines credentials from different factor categories, commonly something you know, something you have, or something you are. Multi-factor authentication, or MFA, is the broader requirement for more than one factor. A password followed by a TOTP from an authenticator is a familiar 2FA workflow. Typing two different passwords does not automatically create two independent factor categories.

Whether an account's flow achieves its intended assurance depends on the implementation. A service may request a code only for new devices, after suspicious sign-ins, or on every login. The existence of an authenticator app does not make every website enforce 2FA. Check the original account security settings and test enrollment while you still have a reliable recovery path.

A TOTP is useful but not phishing resistant

A rotating code raises the bar for someone who has stolen only your password. However, a phishing page can ask for the password and current TOTP, then forward both to the real service immediately. Short lifetime reduces the attack window, but it does not cryptographically bind the code to the legitimate website's origin. Strong device hygiene and verifying the address of the login page still matter.

Where supported, passkeys and modern security keys can use origin-bound cryptography that resists this relay pattern. They are different authenticator technologies and may coexist with TOTP as recovery or backup factors. Do not remove a working recovery method before confirming that the original service supports the alternative and that you have tested it.

Choose the right setup information

If a service presents a QR marked for an authenticator app, inspect whether it contains a supported TOTP setup format. A one-time email code, an HOTP counter token, a recovery code list, and a passkey registration challenge serve different roles. They cannot all be stored or entered through the same TOTP parser. For 2FASync, the safe input is a supported Base32 TOTP setup key or otpauth TOTP URI, rather than any string that happens to look numerical.

The choice of a sign-in factor also affects recovery. Account-issued recovery codes should be kept separate from Vault recovery material and from exported authenticator QR codes. If you migrate devices, verify that the existing service accepts a code from the new authenticator before deleting any previously working credential.

Is every OTP a TOTP?

No. TOTP is one way to produce a time-based OTP; SMS, email and counter-based HOTP are distinct mechanisms.

Do six-digit authenticator codes stop phishing?

Not reliably. A fake sign-in page can relay a valid current code. Use origin-bound passkeys or security keys where your account provider supports them.