Tested with the following apps:

• Aegis (open source) Available via F-Droid and Google Play. It features a built-in QR-code reader.
• FreeOTPPlus (open source) Available via F-droid and Google Play.
• OTP Authenticator (open source) Available via F-Droid and Google Play. It features a built-in QR-code reader.
• Google Authenticator (proprietary)
• KeePassXC (Linux, Windows, macOS) (open-source) Available via download, package repositories or GitHub (Keepass also provides a plugin and Keepass2Android allows you to use a TOTP token)
• SailOTP (SailfishOS) (open source) Available via JollaStore or Openrepos.net
• OTP Auth (proprietary) Available via Apple's App Store
• Authy (Twilio Authy) (proprietary) for Android and IOS. Available via Google Play and Apple's App Store

Tested with the following hardware devices:

• Nitrokey Pro
• Nitrokey Storage

The app is shipped and comes with the installation of Nextcloud Server. No additional steps are necessary, besides activating it.

The app is available through the app store. It can be installed through Nextcloud's app management UI.

Administrators can harden TOTP settings via occ. Changes only affect newly enrolled secrets; existing enrollments continue to work with the algorithm they were created with.

The default algorithm is SHA1 as required by RFC 6238. Stricter environments may prefer SHA256 or SHA512, provided all users' authenticator apps support the chosen algorithm.

occ config:app:set twofactor_totp --type=string algorithm --value=sha256

The generated TOTP secret defaults to 32 Base32 characters (160 bits), which meets the recommendation in RFC 4226. Administrators can increase this for higher entropy requirements.

occ config:app:set twofactor_totp --type=integer secret_length --value=64

Once you enable OTP with Two Factor Totp, your applications (for example your Android app or your GNOME app) will need to login using device passwords. To manage it, know more here

• composer i
• npm ci
• npm run build or npm run dev more info