TOTP — Time-based One-Time Password — is the same standard that powers your bank's two-factor authentication. Every 30 seconds, an algorithm produces a new 6-digit code from a shared secret and the current timestamp.
In Shayr, we use TOTP in a slightly different way. Instead of confirming your identity, the code grants you a temporary view of the shared password. The secret never leaves our encrypted vault. Your device requests a code, our server validates your membership and generates it, and the credential appears for exactly 30 seconds before disappearing.
This means that even if your device is compromised, an attacker can only access the service during that 30-second window. They cannot extract the underlying password. They cannot share it with others. The access is ephemeral by design.
Combined with our audit log — every code request is timestamped and attributed to a verified account — hosts can see exactly who accessed their credential and when. Disputes become factual, not emotional.
The escrow layer closes the loop. Funds sit in a neutral account until the first successful login is confirmed. If access breaks within 7 days, one tap opens a refund window. We settle within 24 hours on business days.