Skip to content
UseQR
ESC

Jump to

↑↓MOVE↵OPEN50 places

Glossary

otpauth URI

otpauth is the URI scheme used in two-factor authentication setup QR codes. An otpauth://totp/ URI carries the account label and a Base32 shared secret, plus optional issuer, digits and period parameters, which an authenticator app stores to generate one-time codes. The secret is unencrypted: anyone who captures the QR can clone the token.

View as MarkdownPaste this page into any AI assistant. It is plain, portable Markdown.

The format

Introduced by Google Authenticator as its "Key Uri Format" and now the de facto standard across authenticator apps:

otpauth://totp/GitHub:alice?secret=JBSWY3DPEHPK3PXP&issuer=GitHub&digits=6&period=30

The type is totp (time-based, the near-universal case) or hotp (counter-based, which adds a counter parameter). secret is the shared key in Base32; digits (default 6), period (default 30 seconds) and algorithm (default SHA1) are optional and, in practice, best left at defaults, several authenticator apps quietly ignore non-default values, then generate wrong codes.

The QR code is nothing special: a static code carrying this URI as its payload. Google Authenticator's export feature uses a related otpauth-migration:// scheme that bundles several accounts into one code.

The secret is in the clear

Everything needed to generate your login codes forever sits unencrypted in that URI. A screenshot of the setup screen, a photo of a recovery sheet, a QR pasted into a ticket or chat: each is a complete, silent copy of the second factor. Treat an otpauth QR like a password: set it up, then destroy or encrypt any capture of it. The exposure risk is detailed in OTP secret exposure in QR screenshots and the wider model in QR codes for 2FA. This is also a case where client-side generation genuinely matters, a secret sent to a server-side QR API has already leaked.

FAQ

What is in a 2FA setup QR code?

An otpauth:// URI: the account label, the Base32 shared secret, and optional issuer, digits, period and algorithm parameters. The authenticator app stores the secret and derives one-time codes from it.

Is it safe to screenshot a 2FA QR code?

No. The screenshot contains the raw secret, and anyone who obtains it can generate your codes indefinitely without your knowledge. If a capture may have leaked, re-enrol to rotate the secret.

Try it: free, no signup

Related

  • Payload, The payload is the actual string encoded in a QR code: the URL, the WIFI: block, the vCard. Everything about a code's size, density and minimum print…
  • Quishing, Quishing is phishing delivered by QR code. It works because the destination is unreadable to a human before scanning, and because a code in an email image…
  • Static QR code, A static QR code contains its destination directly in the pattern. It cannot be edited or tracked, and it never expires, because nothing has to keep…
  • Deep link, A deep link is a URL that opens a specific screen inside an app. As a QR payload it comes in two forms (custom schemes and universal links), with very…