TOTP, Passkeys, and SSH Keys

Authentication means proving you are who you claim to be. You do it at a concert by showing an ID, and online by proving your identity to a website.

Passwords are the weakest version of that proof. Three alternatives do the job better: TOTP, passkeys, and SSH keys.

TOTP (Time-based One-Time Passwords)

A TOTP code is a six-digit number that changes every 30 seconds, derived from a shared secret and the current time.

How TOTP works

1. The website shows you a secret, usually as a QR code
2. You scan it with Google Authenticator, Microsoft Authenticator, or Authy
3. Your app and the website run the same calculation over that secret plus the clock, so both land on the same six digits
4. You type the digits along with your username and password
5. The website compares its number to yours and logs you in if they match

Why TOTP holds up

Someone who steals your password still cannot log in without the six digits. Each code expires in 30 seconds, so a code captured from your screen or a phishing page is worthless a minute later. An attacker needs your password and your phone at the same time.

Passkeys

A passkey replaces the password with your device. You unlock the device, and the device proves your identity.

How passkeys work

1. The website asks you to create a passkey
2. Your phone or laptop generates a key pair: one public, one private
3. The public key goes to the website
4. The private key stays on your device, locked behind your fingerprint, face, or device password
5. At login, the website sends a challenge
6. Your device unlocks the private key after you authenticate, then signs the challenge
7. The website verifies the signature against the public key it stored

Why passkeys hold up

You have no password to forget, reuse, or leak. The private key never leaves your device, so the website never holds a secret worth stealing. When a site with passkey support gets breached, the attacker walks away with public keys, which log in nowhere.

SSH keys

Programmers and system administrators use SSH keys to log into servers. The math matches passkeys. The packaging is more manual.

How SSH keys work

1. You generate a key pair on your machine
2. You copy the public key to the server, GitHub, or your hosting provider
3. On connect, the server sends a challenge
4. Your machine signs it with the private key
5. The server checks the signature against your public key
6. A valid signature gets you a shell

Why SSH keys hold up

The private key stays on your disk and never crosses the network. A public key in the wrong hands gets an attacker nothing. Ed25519 keys run long enough that guessing one is out of reach.

Comparing the three

Method	What you use	Where it fits
TOTP	A code from a phone app	Any site that offers it
Passkeys	Fingerprint or face	Sites that support them
SSH keys	A key file on your disk	Servers, Git hosts, deploy jobs

Which to use

• TOTP: turn it on for email, banking, and social accounts. Most sites offer it.
• Passkeys: use them wherever they appear. Apple, Google, and Microsoft accounts all support them.
• SSH keys: only if you work with servers or push to Git over SSH.

Keychains

A keychain stores passwords, SSH keys, and certificates encrypted on your machine, unlocked by your login password. macOS calls it Keychain, Windows calls it Credential Manager, Linux ships GNOME Keyring or something like it.

The pattern is the same everywhere. An app asks for a stored secret, you approve, and the keychain hands it over. You enter your login password once at boot instead of a passphrase per key.

Store your SSH key passphrase there and your terminal stops asking on every connect. Passkeys already live in the same protected storage on your phone and laptop.

Where this leaves you

A password alone protects very little. Adding TOTP or a passkey costs a few seconds per login and closes off password theft, credential stuffing, and most phishing.

Start with the accounts that can reset everything else: email first, then banking, then anything holding a payment method.