TOTP, Passkeys, and SSH Keys

What is Authentication?

Before we talk about different tools, let’s understand what authentication means. Authentication is simply proving that you are who you say you are. Think of it like showing your ID at a concert — you’re proving you’re the person on that ID card.

On the internet, we need ways to prove our identity to websites and services. There are many ways to do this, and today we’re going to learn about three popular methods that are more secure than just using passwords.

TOTP (Time-based One-Time Passwords)

TOTP stands for Time-based One-Time Password. That’s a fancy way of saying “a password that changes every 30 seconds based on the current time.”

How TOTP Works

Imagine you have a special calculator that generates a new 6-digit code every 30 seconds. Here’s how it works:

1. When you set up TOTP on a website, the website gives you a secret code (usually shown as a QR code)
2. You scan this code with an app like Google Authenticator, Microsoft Authenticator, or Authy
3. Your app and the website both use the same secret and the current time to calculate the same 6-digit number
4. You type this number into the login form along with your username and password
5. The website checks that your number matches theirs — if it does, you’re logged in

Why is TOTP Secure?

TOTP is secure because even if someone steals your password, they still can’t log in without the 6-digit code. And since the code changes every 30 seconds, even if they see one code, they can’t use it later.

The only way someone could log in without your permission is if they somehow get access to both your password AND your phone with the authenticator app. That’s much harder than stealing just a password.

Passkeys

Passkeys are a newer and, many people think, better way to log in. Instead of remembering a password, you use your device (like your phone or computer) to prove who you are.

How Passkeys Work

1. When you create an account with Passkey support, the website asks you to create one
2. Your device (phone, laptop, etc.) creates two special codes — a public key and a private key
3. The public key gets sent to the website and stored there
4. Your private key stays locked on your device, protected by your fingerprint, face, or password
5. When you want to log in later, the website asks you to unlock your device with your fingerprint or face
6. Your device uses the private key to prove to the website that you’re the real owner
7. The website checks your proof and lets you in

Why are Passkeys Secure?

Passkeys are very secure because:

• You don’t have to remember a password (no weak passwords!)
• Your private key never leaves your device (the website never sees it)
• Even if a website gets hacked, hackers only get your public key, which doesn’t help them log in
• Your device makes sure only YOU can use your private key (through fingerprint or face recognition)

SSH Keys

SSH keys are used mainly by computer programmers and system administrators to log into servers. They work similarly to Passkeys, but they’re more technical.

How SSH Keys Work

1. You create a pair of keys on your computer: a public key and a private key
2. You give your public key to a server (like a GitHub server or a web hosting company)
3. When you want to connect to the server, the server asks you to prove your identity
4. Your computer uses your private key to create a special proof
5. The server checks this proof with your public key
6. If the proof is correct, the server lets you connect

Why are SSH Keys Secure?

SSH keys are very secure because:

• Your private key never gets sent anywhere (it stays on your computer)
• Even if someone sees your public key, they can’t use it to log in
• It’s almost impossible to guess an SSH key (they’re very long and random)
• They’re protected by your computer, so if someone tries to steal your key, your computer won’t let them use it without your permission

Comparing the Three Methods

Which Should You Use?

• TOTP: Great for your regular online accounts (email, social media, etc.). If a website offers it, turn it on.
• Passkeys: The future of internet security. Use these when websites offer them. They’re becoming more common.
• SSH Keys: Only if you’re a developer or work with servers. Don’t worry about these if that’s not you.

Keychains

A keychain (or keyring) is a system on your computer that safely stores passwords, SSH keys, and other sensitive information. Think of it like a physical keychain that holds all your keys — except it’s digital and locked.

On macOS, it’s called Keychain. On Windows, it’s called Credential Manager. On Linux, it might be GNOME Keyring or similar. They all work the same way: everything is encrypted and protected by your computer password. When you need a password or key, the app asks “Can I use the password for this website?” and you approve it. You only have to enter your main password once when you log in to your computer.

When you create SSH keys, you can store them in your keychain. This way, you don’t have to remember your SSH key password every time — your computer remembers it for you. Keychains also work great alongside the authentication tools we talked about: you can store your SSH keys safely, passkeys are stored securely on your device, and TOTP apps can sometimes integrate with keychains too.

The main benefits of using a keychain are security (everything is encrypted), convenience (you don’t have to remember multiple passwords), and centralization (all your sensitive info in one protected place).

Final Thoughts

Passwords alone are not very secure anymore. Using TOTP or Passkeys on top of a password makes your accounts much safer. It might take a few extra seconds to log in, but protecting your accounts is worth it.

The best practice is to use whatever your most important accounts (email, banking, social media) offer. Most offer either TOTP or Passkeys, and using either one is much better than using just a password.

Stay safe out there!