# OTP secret exposure — the 2FA screenshot problem

> A screenshot of a 2FA setup QR code stores your TOTP secret in your camera roll, where cloud sync copies it to servers and shared devices. The secret never expires, so anyone with the image can mint valid codes years later. Deleting the photo is not enough — disable and re-enrol 2FA to rotate the secret.

Source: https://useqr.app/docs/security/otp-secret-exposure-in-qr-screenshots · Last reviewed 2026-08-21 · UseQR is free forever, MIT licensed, no signup.

---

## What the screenshot actually captures

The setup QR encodes an [otpauth URI](/glossary/otpauth) whose `secret` parameter is the
shared key your codes are computed from — the full anatomy is in the
[2FA security model](/docs/security/qr-codes-for-2fa-security-model). A screenshot is not
a picture *of* your 2FA; it **is** your 2FA. Anyone holding the image can
[scan it straight from the screen](/docs/scanning/how-to-scan-a-qr-code-from-a-screenshot)
into their own authenticator and produce codes identical to yours.

Two properties make this worse than most credential leaks:

- **TOTP secrets never expire.** A photo taken in 2022 mints valid codes today; there is
  no rotation unless you force one.
- **The leak is silent.** An attacker's codes are indistinguishable from yours, so
  nothing in the service's logs flags the duplicate.

## Where the copy travels

A screenshot does not stay in one place:

| Path | What happens |
|---|---|
| Cloud photo sync | iCloud Photos or Google Photos uploads it within moments, across every signed-in device |
| Deleted-photo retention | "Recently Deleted" on iOS keeps images about **30 days**; Google Photos' bin holds them for up to **60 days** |
| Backups | Device and computer backups carry the image forward indefinitely |
| Shared albums and chats | One tap sends the secret to another person's library |
| Screen recording and sharing | Help-desk sessions, meeting recordings and streams capture the setup screen |

Each hop is another store you would need to purge — which is why purging is the wrong
strategy.

## Incident response — rotate, do not just delete

If a setup QR was screenshotted, photographed or shown on a shared screen, treat the
secret as copied. Deleting the image removes one copy of many; the fix is to make every
copy worthless:

1. Sign in to the affected account and **remove or disable the authenticator entry**.
2. **Re-enrol 2FA immediately.** Setup issues a **fresh secret**; the old one — and every
   image of it — stops working the moment the service switches over.
3. Confirm the rotation: a code from the old enrolment (or the saved image) must now be
   rejected.
4. Then, and only then, tidy up: delete the images, empty the deleted-photos folder, and
   check shared albums and chat threads.

Step 2 is the entire defence. The other steps are hygiene.

## The sanctioned copy — backup codes

The urge behind the screenshot is legitimate: people fear losing their phone and being
locked out. Services anticipate this with **single-use backup codes**, which are the
designed-for-storage answer — each works once, they can be revoked and regenerated at any
time, and their loss does not expose the generator behind your everyday codes. Store them
in a password manager or printed somewhere genuinely offline. A screenshot of a QR is a
permanent master key in your camera roll; a backup code list is a revocable spare — the
comparison is not close. And the broader instinct is right in general:
[a QR code cannot take data from your phone](/docs/security/can-a-qr-code-steal-your-data),
but a photo of a secret-bearing code hands data to anyone who sees it.

## FAQ

### Is it safe to screenshot a 2FA QR code?

No. The screenshot contains the shared secret in plain text, cloud sync spreads it across
devices and servers, and the secret never expires. Use the service's single-use backup
codes as your recovery copy instead.

### I screenshotted my 2FA setup code — what should I do?

Assume the secret is copied. Disable and re-enrol 2FA on that account so a fresh secret is
issued and the old one stops working, verify old codes are rejected, then delete the
images including the deleted-photos folder.

### Do 2FA QR codes expire?

The enrolment screen may time out, but the secret inside the QR does not expire. An image
of the code generates valid logins indefinitely until you rotate the secret by
re-enrolling.

### Are backup codes safer than saving the QR?

Yes. Backup codes are single-use and revocable — losing them costs a bounded amount and
can be undone by regenerating. A saved QR is the permanent generator of all future codes,
and revoking it requires re-enrolling 2FA entirely.

## Try it

- https://useqr.app/text
- https://useqr.app/scan