diff --git a/agent/user/mfa_enforcement.php b/agent/user/mfa_enforcement.php
index da1af665..ebf26076 100644
--- a/agent/user/mfa_enforcement.php
+++ b/agent/user/mfa_enforcement.php
@@ -12,7 +12,7 @@ $company_logo = escapeHtml($row['company_logo']);
 
 // Only generate the token once and store it in session:
 if (empty($_SESSION['mfa_token'])) {
-    $token = key32gen();
+    $token = generateTotpSecret();
     $_SESSION['mfa_token'] = $token;
 }
 $token = $_SESSION['mfa_token'];
diff --git a/agent/user/modals/user_mfa_modal.php b/agent/user/modals/user_mfa_modal.php
index 571ce4ad..298de09c 100644
--- a/agent/user/modals/user_mfa_modal.php
+++ b/agent/user/modals/user_mfa_modal.php
@@ -3,7 +3,7 @@ require_once '../../libs/totp/totp.php';
 
 // Only generate the token once and store it in session:
 if (empty($_SESSION['mfa_token'])) {
-    $token = key32gen();
+    $token = generateTotpSecret();
     $_SESSION['mfa_token'] = $token;
 }
 $token = $_SESSION['mfa_token'];
diff --git a/functions/security.php b/functions/security.php
index 4556ab5d..ce9dce4a 100644
--- a/functions/security.php
+++ b/functions/security.php
@@ -14,8 +14,8 @@ function randomString(int $length = 16): string {
     );
 }
 
-// Used only for TOTP
-function key32gen() {
+// Generate a cryptographically secure 32-char base32 secret for TOTP
+function generateTotpSecret() {
     $chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
     $key = '';
     for ($i = 0; $i < 32; $i++) {