# How to use TOTP authentication

> Scan a website's authenticator QR code in a PersonaHub profile browser, save the TOTP entry, and copy rotating codes from the extension or management page.

Source: https://console.getchrovia.com/en/docs/totp

TOTP is a time-based one-time password. After you enable authenticator-based two-step verification on a website, it typically asks for this code during sign-in. PersonaHub saves authenticator entries separately for each profile and displays the current code with its remaining validity time.

This guide uses Proton's authenticator setup as an example. First, [launch the profile browser](https://console.getchrovia.com/en/docs/launch-profile) and sign in to the website there. Do not scan from a different profile or your system browser. Authenticator features are available on both Free and Pro plans.

## 1. Display the website's authenticator QR code

Open the website's account security settings and choose an authenticator app. The screenshot shows Proton's **Account and password** page with the **Set up authenticator app** dialog opened from **Authenticator app** settings.

Keep the entire QR code visible in the current page. Click the PersonaHub extension icon in the browser toolbar, open **Authenticator**, and click **Scan QR code**.

![Proton's authenticator setup QR code and the extension's Scan QR code button](https://console.getchrovia.com/docs/screenshots/totp-scan.webp)

The extension scans the visible area of the active tab; no phone camera is needed. The QR code is hidden in the screenshot. Use the complete code displayed by the website for your own account.

## 2. Check the saved entry and finish verification

After a successful scan, the extension shows a **Saved** message and a new code card. In the screenshot, the entry starts with **Proton** and shows a six-digit code, seconds remaining, and **Copy** and **Delete** buttons.

![Saved message and a Proton authenticator entry with a rotating code and countdown](https://console.getchrovia.com/docs/screenshots/totp-saved.webp)

Click **Copy**, then return to the website to continue setup. The next button in the screenshot is **Next**. Follow the site's remaining steps, enter the current code, and complete verification. A **Saved** message only confirms that the authenticator entry was saved; it does not mean two-step verification is already enabled on the website.

Codes change over time, so do not use the numbers in these screenshots. If the countdown is about to finish, wait for a new code before copying it.

## 3. Open Authenticator in PersonaHub

Return to **My profiles** in PersonaHub, find the profile you used, and click **Authenticator**.

![Authenticator button for David Morrison in My profiles](https://console.getchrovia.com/docs/screenshots/totp-button.webp)

## 4. View and copy the current code

The page title identifies the profile. Each entry shows the website and account, the current code, and seconds remaining. The screenshot shows the Proton entry under **Authenticator · David Morrison**.

![PersonaHub Authenticator page showing a Proton entry, rotating code, countdown, and Copy button](https://console.getchrovia.com/docs/screenshots/totp-list.webp)

When the website asks for an authenticator code, click **Copy** here and paste it into the website. You can also copy it directly from the extension in the profile browser. Click **Refresh** if a newly scanned entry has not appeared.

## Deleting entries and troubleshooting

- **Delete an entry**: Click its **Delete** button. The management page asks for confirmation. After deletion, that entry can no longer generate codes. Removing it from PersonaHub does not disable two-step verification on the website.
- **No QR code found**: Check that the entire QR code is visible in the active tab. Adjust the scroll position or zoom and try again.
- **Unsupported QR code**: Use the TOTP QR code from the website's authenticator-app setup, not a QR code for sign-in, payment, or another purpose.
- **Code rejected**: Check that the entry belongs to the correct website account, the code has not expired, and your computer's date and time are accurate. If the website generated a new authenticator secret, scan its new QR code.
- **Extension cannot load or save**: Keep PersonaHub running and signed in, and check the network connection. If needed, close the profile browser and launch it again from PersonaHub.

TOTP and website passwords are different credentials. For passwords, see [How to manage website passwords](https://console.getchrovia.com/en/docs/password-management). If the website supports passkeys, see [How to use passkeys](https://console.getchrovia.com/en/docs/passkeys).