Choosing a factor
Two ways to prove the same thing, with very different mechanics.
Both factors answer "is the person at the keyboard really this user?". TOTP answers it with arithmetic both sides can do independently. Push answers it by reaching a specific device the user has already registered. Most products end up offering both — TOTP as the universal fallback, push as the one people actually enjoy using.
| TOTP codes | Push approvals | |
|---|---|---|
| What the person does | Opens any authenticator app, reads six digits, types them | Gets a notification and taps the matching number |
| Needs the U2 Secured app? | No — any RFC 6238 authenticator app the user already has | Yes, paired to your app with a pairing code |
| Works offline | Yes, entirely | No — the device has to be reachable |
| What we store | Nothing. The secret lives in your database and reaches us only inside each verification request | The device registry, the pending approval, and the link between your user identifier and that device |
| Enrolment list in the portal | None — we have no record of a TOTP enrolment to show you | Yes — paired devices are listed and can be revoked |
| What counts toward your plan | Verifications you make | Approvals you request |
Reach for TOTP when
- You want every user covered on day one, without asking anyone to install your choice of app.
- Your users may be offline, on aeroplanes, or behind restrictive networks.
- You are comfortable storing a secret per user and encrypting it at rest.
- You need a fallback for when push cannot be delivered.
Reach for push when
- You want a one-tap sign-in rather than a retyped code.
- You want to show the user what they are approving — "Login from Chrome on macOS" — so a phished prompt looks wrong.
- You want to see who is enrolled, on what device, and revoke it centrally.
Offering both is the common case
Nothing prevents a user having both. A typical setup enrols TOTP during signup so nobody is locked out, then offers push as an upgrade once they install the app — falling back to TOTP whenever a push cannot be delivered.