# The security model of 2FA setup QR codes

> The QR code shown during 2FA setup carries your shared secret in plain text inside an otpauth URI. Anyone who captures that image can generate your codes indefinitely, which is why apps display it exactly once. The QR is a convenient transport for the secret, not a security feature in itself.

Source: https://useqr.app/docs/security/qr-codes-for-2fa-security-model · Last reviewed 2026-08-21 · UseQR is free forever, no signup.

---

## What the setup QR actually contains

When a service walks you through authenticator setup, the QR on screen encodes an
[otpauth URI](/glossary/otpauth), plain text, like any other code:

```
otpauth://totp/Example:alice@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Example&algorithm=SHA1&digits=6&period=30
```

| Field | Meaning | Common default |
|---|---|---|
| `secret` | The shared secret, base32-encoded | typically a 160-bit value (32 base32 characters) |
| `issuer` / label | Which service and account | n/a |
| `algorithm` | HMAC hash | SHA-1 |
| `digits` | Code length | 6 |
| `period` | Code lifetime | 30 seconds |

Everything except the secret is bookkeeping. The secret **is** your second factor.

## How TOTP works, in one paragraph

Your authenticator and the server hold the same secret. Every 30 seconds, both compute an
HMAC of the current time window (`floor(unixtime / 30)`) keyed with the secret, and
truncate the result to 6 digits: the algorithms are public standards, RFC 4226 (HOTP) and
RFC 6238 (TOTP). Matching codes prove matching secrets; there is no server round trip, no
randomness, and nothing else in play. Whoever holds the secret can compute every future
code, forever.

## The one-time exposure window

That is why the QR appears **exactly once**. The secret has to move from server to phone
somehow, and a QR scan is the friendliest transport, no typing 32 characters. But during
those seconds on screen, the secret is sitting in cleartext, and any copy is a permanent
duplicate code generator. The QR is a convenience for the enrolment ceremony, not a
security mechanism: [scanning it does nothing special to your
phone](/docs/security/what-a-qr-code-can-and-cannot-do-to-your-phone). It just hands the
text, and the secret inside it, to whatever app reads it.

## Hygiene for the enrolment ceremony

- **Do not screenshot or photograph the QR.** The consequences and the clean-up are the
  subject of [OTP secret exposure in
  screenshots](/docs/security/otp-secret-exposure-in-qr-screenshots).
- **Enrol privately.** Not while screen sharing, not on a projector, not with a webcam
  pointed at the monitor. Treat the setup screen like a password being displayed,
  because that is what it is.
- **Use the sanctioned copy.** Services offer single-use backup codes precisely so you do
  not need to keep the QR; store those in a password manager instead.
- **Re-enrol rather than re-use.** If you rebuild a phone or suspect exposure, go through
  setup again, a proper re-enrolment issues a **fresh secret** and invalidates the old
  one, which mere re-scanning of a saved image would not.

## What an attacker with the secret can and cannot do

With the secret alone, an attacker can mint valid 6-digit codes indefinitely, but they
still need your password; the secret is the second factor, not the first. Exposure
degrades your account from two factors to one, silently. That silence is the danger: a
leaked password often announces itself through login alerts, while a copied secret makes
the attacker's logins look exactly like yours, codes and all.

## FAQ

### Why does 2FA setup use a QR code?

The server must hand your phone a shared secret of around 32 base32 characters. A QR scan
transfers it instantly and without typos; the alternative (typing the secret manually)
is offered as a fallback on the same screen.

### What is inside a 2FA QR code?

An otpauth URI containing the account label, the issuer, and the shared secret in base32,
plus parameters, almost always SHA-1, 6 digits and a 30-second period. It is plain text;
any scanner can read it.

### Can someone hack me if they saw my 2FA QR code?

Anyone who captured the QR holds your secret and can generate valid codes forever. They
still need your password, but your second factor is gone. Re-enrol 2FA on that account so
a fresh secret is issued.

### Can I scan the same 2FA QR code on two phones?

Technically yes, both devices derive identical codes from the same secret. Some people do
this deliberately as a backup, but every extra copy widens the exposure surface; single-use
backup codes are the safer redundancy.

## Try it

- https://useqr.app/text
- https://useqr.app/scan
- https://useqr.app/validate