How to use it

The problem

"Hi Mum, I've lost my phone, this is my new number, can you send me £300?" used to be a text. Now it can be a phone call in your child's actual voice, cloned from a TikTok clip. Old-fashioned family code words help, but a fixed word can be overheard, guessed, or coaxed out of someone once and reused forever.

The idea

Authenticator apps already solve "prove you hold a secret without saying the secret". Phones holding the same secret show the same six-digit code at the same time, and the code changes every thirty seconds. So everyone gets a personal code: Rob's code lives on Rob's phone and on the phones of the people who need to check it's Rob. When Rob rings, he reads his code and they look at the "Rob" entry in their app. A scammer with a cloned voice can't produce it.

And it goes both ways. Jac has her own code, held by Rob and anyone else who needs to check it's her. So Rob can check he's talking to Jac, and Jac can check she's talking to Rob.

Setting it up

1. Do it in person, or on a call you already trust. You're about to share a secret, so don't do it over a channel you're worried about.
2. Open the generator and type your name — "Rob". That's the label the authenticator app shows.
3. Scan your QR code into your own authenticator app. Any app that does "two-factor codes" works: Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden, Apple Passwords, Aegis, Ente Auth.
4. Let the people who need to check it's you scan the same QR into their apps. Mum, Jac, your sister — whoever you might ring asking for help.
5. Check the numbers match across all the apps and the page.
6. Now do theirs. Generate a new code with Jac's name on it; Jac scans it, and so do you. Repeat for each person.
7. Close the page. If a phone is ever lost, generate a fresh code for that person and have everyone re-scan; don't try to keep the old one.

Why one per person rather than one per pair? Because with a pair code nobody can tell which end is speaking, and it doesn't scale — five family members would need ten of them. With a personal code, "Rob's code" means Rob, and anyone who needs to check Rob just holds that one entry.

On a call

Agree in advance that anyone can ask at any time, and that asking is never rude. Then, when something feels off:

And if they're not sure it's you, read them yours. Both directions, whenever either of you wants.

What it protects against

• Voice-cloned calls pretending to be a family member
• "New number" messages asking for money
• Anyone who has learned your old fixed code word

What it doesn't protect against

• A stolen or unlocked phone. Whoever holds the phone holds every code on it — their own and everyone else's. Keep a lock on it, and if a phone is lost, generate fresh codes for every person whose entry was on it.
• Someone relaying codes live. If an attacker is on a call with the real person at the same moment and asks them for their code, they can pass it on within the thirty seconds. Rare, but possible. If a code arrives suspiciously late, ask for the next one.
• Pressure. The whole point is to give you a reason to pause. If someone is pushing you to skip the check, that's the signal.
• The people you trusted with your code. Anyone holding "Rob" could read Rob's code to someone else who holds it. Share your code only with people who need to check it's you, and keep that circle small.

How it works, for the curious

It's standard TOTP (RFC 6238): a random 160-bit secret, HMAC-SHA1 over the current 30-second window, six digits. The page generates the secret with your browser's cryptographic random number generator and packages it as an otpauth:// URI inside the QR code, which is exactly what any website does when it sets up two-factor login. Nothing is sent to a server — there is no server — and the page carries a Content Security Policy that forbids it from making network requests at all. You can read the source, or save the page and run it from your own computer with the Wi-Fi off.