Enigma Technologies Solutions · TOTP for Sanctum · RFC 6238
\nonetime
codes
\n Two-factor codes, generated inside Sanctum. Your username and password never leave this window. They derive an AES-256 key that encrypts every secret before it is written to this tool's own storage. The tool asks for no network access. With a YubiKey and smart card access approved, secrets can live on the key instead, and codes are computed by the key.
\n \n \n \n01 · Access
\nUnlock your vault
\nEnter the username and password you chose when the vault was created. The fingerprint below is computed from what you type. If it matches the one you remember, the combination is right.
\n\nA one-way value derived from the same master key as the encryption key. It reveals nothing about the password or the key; it only gives you a picture to recognise. Different input, different picture.
\nBackups
\nRestore an encrypted backup made with Copy backup. Paste it below or choose a saved .json file, then unlock it with the original username and password.
\n \n02 · Add a key
\nNew authenticator key
\nPaste the setup key a website shows next to its QR code (for example aaaa bbbb cccc dddd eeee ffff gggg hhhh) or a full otpauth://totp/... link. Spaces and case do not matter.
03 · Codes
\nYour one-time codes
\nClick a code to copy it. Codes turn red in the last five seconds of their window.
\n \n \n04 · YubiKey
\nCodes computed by your key
\nThe YubiKey OATH applet keeps each secret inside the key and returns only the code. Nothing about these accounts is stored in this tool. This needs Sanctum's smart card access, approved for the OATH (TOTP/HOTP) applet only.
\n \n05 · Vault
\nBackup and password
\nCopy the encrypted vault to the clipboard as JSON, then paste it into a file or a password manager note. It stays encrypted; you need the same username and password to open it. Accounts stored on a YubiKey are not part of the backup.
\n \n \n \nRemove this vault from this tool's storage. This cannot be undone without a backup.
\n \n