Generate Time-based One-Time Passwords (RFC 6238) — compatible with Google Authenticator and similar apps.