Repository navigation
Comparison with other providers
Tip
TL;DR twofactor_totp covers simple self-service TOTP; twofactor_oath adds HOTP, OCRA, per-token settings, custom secrets and central provisioning, and imports twofactor_totp accounts losslessly.
twofactor_totp ships with Nextcloud and covers simple self-service TOTP. twofactor_oath is the advanced alternative and can run alongside it. For a clean setup the recommended path is to import the existing accounts (only offered while twofactor_totp is enabled) and then disable twofactor_totp, see Migrating from twofactor_totp. Because both apps store secrets the same way, the import is lossless and users keep working without re-enrolling.
| twofactor_oath | twofactor_totp | |
|---|---|---|
| TOTP | yes | yes |
| HOTP | yes | no |
| OCRA (challenge-response) | yes | no |
| Per-token algorithm / digits / period | yes | algorithm only, instance-wide |
| Custom (predetermined) secret | yes | no |
| Admin-managed enrollment and lock | yes | no |
| Bulk provisioning, CSV, import | yes | no |
| Readable, editable account label | yes | no |
| Re-display an existing secret and QR | yes (password-confirmed, 60 s auto-hide) | no |
| Password required to disable | yes (see Security model) | no |
| App | Second factor | TOTP | HOTP | OCRA | Per-token algorithm / digits / period | Custom secret | Admin lock and bulk | OTP library |
|---|---|---|---|---|---|---|---|---|
| twofactor_oath (this app) | OATH OTP (app or hardware) | yes | yes | yes | yes | yes | yes | spomky-labs/otphp plus own OCRA |
| twofactor_totp (bundled) | TOTP (app) | yes | no | no | algorithm only, instance-wide | no | no | rullzer/easytotp |
| twofactor_webauthn | WebAuthn / FIDO2 | n/a | n/a | n/a | n/a | n/a | partial | n/a |
| twofactor_gateway | SMS / Telegram / Signal | n/a | n/a | n/a | n/a | n/a | no | n/a |
| twofactor_nextcloud_notification | Push approval | n/a | n/a | n/a | n/a | n/a | no | n/a |
| twofactor_backupcodes (core) | One-time backup codes | n/a | n/a | n/a | n/a | n/a | no | n/a |
Two further differences are not in the table: this app requires a fresh password to disable the provider, and it can re-display an existing secret and QR under a forced password with a 60-second auto-hide. See Security model.
How the methods behind these apps compare in security terms (delivery channel, hardware isolation, phishing resistance) is laid out in Security model, section How the second-factor methods compare.
