This project handles TOTP shared secrets.

• real Base32 seeds
• Google Authenticator export QR images
• otpauth:// URIs
• otpauth-migration:// URIs
• screenshots of live OTPs
• firmware files containing real secrets

The Arduino stores secrets in flash. A button/passcode gate can hide the displayed codes from casual viewing, but it does not stop firmware extraction.

Keep the device physically controlled. Treat it like a password vault.

Good fit:

• lab accounts
• desktop convenience for selected accounts
• private office display under your physical control

For highest-risk accounts, prefer FIDO2/WebAuthn hardware keys where available.

The future six-button add-on is primarily for paging/navigation and display control.

Any passcode/reveal feature should be treated as casual-view protection only. It does not encrypt or protect the Base32 seeds stored in firmware.