OTP secret exposure: the 2FA screenshot problem

What the screenshot actually captures

The setup QR encodes an otpauth URI whose secret parameter is the shared key your codes are computed from: the full anatomy is in the 2FA security model. A screenshot is not a picture of your 2FA; it is your 2FA. Anyone holding the image can scan it straight from the screen into their own authenticator and produce codes identical to yours.

Two properties make this worse than most credential leaks:

• TOTP secrets never expire. A photo taken in 2022 mints valid codes today; there is no rotation unless you force one.
• The leak is silent. An attacker's codes are indistinguishable from yours, so nothing in the service's logs flags the duplicate.

Where the copy travels

A screenshot does not stay in one place:

Path	What happens
Cloud photo sync	iCloud Photos or Google Photos uploads it within moments, across every signed-in device
Deleted-photo retention	"Recently Deleted" on iOS keeps images about 30 days; Google Photos' bin holds them for up to 60 days
Backups	Device and computer backups carry the image forward indefinitely
Shared albums and chats	One tap sends the secret to another person's library
Screen recording and sharing	Help-desk sessions, meeting recordings and streams capture the setup screen

Each hop is another store you would need to purge, which is why purging is the wrong strategy.

Incident response: rotate, do not just delete

If a setup QR was screenshotted, photographed or shown on a shared screen, treat the secret as copied. Deleting the image removes one copy of many; the fix is to make every copy worthless:

1. Sign in to the affected account and remove or disable the authenticator entry.
2. Re-enrol 2FA immediately. Setup issues a fresh secret; the old one (and every image of it) stops working the moment the service switches over.
3. Confirm the rotation: a code from the old enrolment (or the saved image) must now be rejected.
4. Then, and only then, tidy up: delete the images, empty the deleted-photos folder, and check shared albums and chat threads.

Step 2 is the entire defence. The other steps are hygiene.

The sanctioned copy: backup codes

The urge behind the screenshot is legitimate: people fear losing their phone and being locked out. Services anticipate this with single-use backup codes, which are the designed-for-storage answer: each works once, they can be revoked and regenerated at any time, and their loss does not expose the generator behind your everyday codes. Store them in a password manager or printed somewhere genuinely offline. A screenshot of a QR is a permanent master key in your camera roll; a backup code list is a revocable spare: the comparison is not close. And the broader instinct is right in general: a QR code cannot take data from your phone, but a photo of a secret-bearing code hands data to anyone who sees it.

FAQ

Is it safe to screenshot a 2FA QR code?

No. The screenshot contains the shared secret in plain text, cloud sync spreads it across devices and servers, and the secret never expires. Use the service's single-use backup codes as your recovery copy instead.

I screenshotted my 2FA setup code: what should I do?

Assume the secret is copied. Disable and re-enrol 2FA on that account so a fresh secret is issued and the old one stops working, verify old codes are rejected, then delete the images including the deleted-photos folder.

Do 2FA QR codes expire?

The enrolment screen may time out, but the secret inside the QR does not expire. An image of the code generates valid logins indefinitely until you rotate the secret by re-enrolling.

Are backup codes safer than saving the QR?

Yes. Backup codes are single-use and revocable: losing them costs a bounded amount and can be undone by regenerating. A saved QR is the permanent generator of all future codes, and revoking it requires re-enrolling 2FA entirely.