diff --git a/classes/pref/prefs.php b/classes/pref/prefs.php
index 512e31453b760d320fb3310d039c6ee6a9630215..1eaa993459c04217d27dc886575216443caabdae 100644
--- a/classes/pref/prefs.php
+++ b/classes/pref/prefs.php
@@ -469,8 +469,8 @@ class Pref_Prefs extends Handler_Protected {
 					<?= \Controls\hidden_tag("method", "otpenable") ?>
 
 					<fieldset>
-						<label><?= __("OTP Key:") ?></label>
-						<input dojoType='dijit.form.ValidationTextBox' disabled='disabled' value="<?= $otp_secret ?>" style='width : 215px'>
+						<label><?= __("OTP secret:") ?></label>
+						<code><?= $this->format_otp_secret($otp_secret) ?></code>
 					</fieldset>
 
 					<!-- TODO: return JSON from the backend call -->
@@ -496,7 +496,7 @@ class Pref_Prefs extends Handler_Protected {
 					</fieldset>
 
 					<fieldset>
-						<label><?= __("One time password:") ?></label>
+						<label><?= __("Verification code:") ?></label>
 						<input dojoType='dijit.form.ValidationTextBox' autocomplete='off' required='1' name='otp'>
 					</fieldset>
 
@@ -1518,4 +1518,8 @@ class Pref_Prefs extends Handler_Protected {
 		}
 		return "";
 	}
+
+	private function format_otp_secret($secret) {
+		return implode(" ", str_split($secret, 4));
+	}
 }
diff --git a/classes/userhelper.php b/classes/userhelper.php
index ce26e6c71cb9c60fccb6431b320f66aeca73e6f5..0bf67243ef0b3cd9a5336fff2c5dc44a4fa104c2 100644
--- a/classes/userhelper.php
+++ b/classes/userhelper.php
@@ -299,7 +299,7 @@ class UserHelper {
 					if ($user->otp_enabled) {
 						$user->otp_secret = $salt_based_secret;
 					} else {
-						$user->otp_secret = bin2hex(get_random_bytes(6));
+						$user->otp_secret = bin2hex(get_random_bytes(10));
 					}
 
 					$user->save();
diff --git a/plugins/auth_internal/init.php b/plugins/auth_internal/init.php
index 8c115456685d601008f110481142a9d19852df86..3f5a2e9779b8175dc1e6f0e1691464cecbbadcb3 100644
--- a/plugins/auth_internal/init.php
+++ b/plugins/auth_internal/init.php
@@ -109,7 +109,7 @@ class Auth_Internal extends Auth_Base {
 										<?= \Controls\hidden_tag("op", "login") ?>
 
 										<fieldset>
-											<label><?= __("Please enter your one time password:") ?></label>
+											<label><?= __("Please enter verification code (OTP):") ?></label>
 											<input id="otp" dojoType="dijit.form.ValidationTextBox" required="1" autocomplete="off" size="6" name="otp" value=""/>
 											<?= \Controls\submit_tag(__("Continue")) ?>
 										</fieldset>