Passkeys remove passwords and phishing in one move, and we are glad they are spreading. But coverage is uneven.
- Thousands of services still only offer TOTP as a second factor.
- TOTP works offline, on any device, with no vendor lock-in.
- It is a simple, auditable standard: a shared secret and the current time.
Authly implements RFC 6238 exactly, so any service that speaks TOTP works — and your codes keep generating even with no connection.