# `TotpSecret`

An authenticator's shared secret (RFC 6238): 16 to 64 bytes as RFC 4648 Base32 in upper case, unpadded. A secret value, stored once keys held as data arrive.

[Security](types.md#security); not ordered; since Jadpo 0.1.0.

## Make one

It comes from outside your code, a secret value that never appears in it.

`text.parse(raw, as: TotpSecret)` reads one from its text; text that isn't one at all fails `malformed`, such as `gezdgnbvgy3tqojqgezdgnbvgy3tqojq`, `GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ====` or `GAYTEMZUGU3DOOBZ`.

## Text, JSON and storage

`text.parse` reads one from its text, as it is typed. Nothing writes it: `text.from` and `text.format` don't take it, JSON writes it as `"<redacted TotpSecret>"`, and it is never stored.

## Shown to people

`text.format` doesn't take it: a `TotpSecret` is never shown.

## Operations

It has the contract's own operations: `text.parse`, `json.read`, `json.write` and `==`. It isn't ordered, so `<` and sorting don't take it. [Every standard type meets one contract](../topics/every-standard-type-meets-one-contract.md) says how they work.