The security model of 2FA setup QR codes

What the setup QR actually contains

When a service walks you through authenticator setup, the QR on screen encodes an otpauth URI — plain text, like any other code:

otpauth://totp/Example:alice@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Example&algorithm=SHA1&digits=6&period=30

Field	Meaning	Common default
secret	The shared secret, base32-encoded	typically a 160-bit value (32 base32 characters)
issuer / label	Which service and account	—
algorithm	HMAC hash	SHA-1
digits	Code length	6
period	Code lifetime	30 seconds

Everything except the secret is bookkeeping. The secret is your second factor.

How TOTP works, in one paragraph

Your authenticator and the server hold the same secret. Every 30 seconds, both compute an HMAC of the current time window (floor(unixtime / 30)) keyed with the secret, and truncate the result to 6 digits — the algorithms are public standards, RFC 4226 (HOTP) and RFC 6238 (TOTP). Matching codes prove matching secrets; there is no server round trip, no randomness, and nothing else in play. Whoever holds the secret can compute every future code, forever.

The one-time exposure window

That is why the QR appears exactly once. The secret has to move from server to phone somehow, and a QR scan is the friendliest transport — no typing 32 characters. But during those seconds on screen, the secret is sitting in cleartext, and any copy is a permanent duplicate code generator. The QR is a convenience for the enrolment ceremony, not a security mechanism: scanning it does nothing special to your phone — it just hands the text, and the secret inside it, to whatever app reads it.

Hygiene for the enrolment ceremony

• Do not screenshot or photograph the QR. The consequences and the clean-up are the subject of OTP secret exposure in screenshots.
• Enrol privately. Not while screen sharing, not on a projector, not with a webcam pointed at the monitor. Treat the setup screen like a password being displayed — because that is what it is.
• Use the sanctioned copy. Services offer single-use backup codes precisely so you do not need to keep the QR; store those in a password manager instead.
• Re-enrol rather than re-use. If you rebuild a phone or suspect exposure, go through setup again — a proper re-enrolment issues a fresh secret and invalidates the old one, which mere re-scanning of a saved image would not.

What an attacker with the secret can and cannot do

With the secret alone, an attacker can mint valid 6-digit codes indefinitely — but they still need your password; the secret is the second factor, not the first. Exposure degrades your account from two factors to one, silently. That silence is the danger: a leaked password often announces itself through login alerts, while a copied secret makes the attacker's logins look exactly like yours, codes and all.

FAQ

Why does 2FA setup use a QR code?

The server must hand your phone a shared secret of around 32 base32 characters. A QR scan transfers it instantly and without typos; the alternative — typing the secret manually — is offered as a fallback on the same screen.

What is inside a 2FA QR code?

An otpauth URI containing the account label, the issuer, and the shared secret in base32, plus parameters — almost always SHA-1, 6 digits and a 30-second period. It is plain text; any scanner can read it.

Can someone hack me if they saw my 2FA QR code?

Anyone who captured the QR holds your secret and can generate valid codes forever. They still need your password, but your second factor is gone. Re-enrol 2FA on that account so a fresh secret is issued.

Can I scan the same 2FA QR code on two phones?

Technically yes — both devices derive identical codes from the same secret. Some people do this deliberately as a backup, but every extra copy widens the exposure surface; single-use backup codes are the safer redundancy.