# otpauth URI

> otpauth is the URI scheme used in two-factor authentication setup QR codes. An otpauth://totp/ URI carries the account label and a Base32 shared secret, plus optional issuer, digits and period parameters, which an authenticator app stores to generate one-time codes. The secret is unencrypted — anyone who captures the QR can clone the token.

Source: https://useqr.app/glossary/otpauth · Last reviewed 2026-08-21 · UseQR is free forever, MIT licensed, no signup.

---

## The format

Introduced by Google Authenticator as its "Key Uri Format" and now the de facto standard
across authenticator apps:

```
otpauth://totp/GitHub:alice?secret=JBSWY3DPEHPK3PXP&issuer=GitHub&digits=6&period=30
```

The type is `totp` (time-based, the near-universal case) or `hotp` (counter-based, which
adds a `counter` parameter). `secret` is the shared key in **Base32**; `digits` (default
**6**), `period` (default **30** seconds) and `algorithm` (default **SHA1**) are optional
and, in practice, best left at defaults — several authenticator apps quietly ignore
non-default values, then generate wrong codes.

The QR code is nothing special: a [static code](/glossary/static-qr-code) carrying this URI
as its [payload](/glossary/payload). Google Authenticator's export feature uses a related
`otpauth-migration://` scheme that bundles several accounts into one code.

## The secret is in the clear

Everything needed to generate your login codes forever sits unencrypted in that URI. A
screenshot of the setup screen, a photo of a recovery sheet, a QR pasted into a ticket or
chat — each is a complete, silent copy of the second factor. Treat an otpauth QR like a
password: set it up, then destroy or encrypt any capture of it. The exposure risk is
detailed in [OTP secret exposure in QR screenshots](/docs/security/otp-secret-exposure-in-qr-screenshots)
and the wider model in [QR codes for 2FA](/docs/security/qr-codes-for-2fa-security-model).
This is also a case where [client-side generation](/docs/security/client-side-vs-server-side-qr-generation)
genuinely matters — a secret sent to a server-side QR API has already leaked.

## FAQ

### What is in a 2FA setup QR code?
An otpauth:// URI: the account label, the Base32 shared secret, and optional issuer, digits, period and algorithm parameters. The authenticator app stores the secret and derives one-time codes from it.

### Is it safe to screenshot a 2FA QR code?
No. The screenshot contains the raw secret, and anyone who obtains it can generate your codes indefinitely without your knowledge. If a capture may have leaked, re-enrol to rotate the secret.

## Try it

- https://useqr.app/url
- https://useqr.app/text
- https://useqr.app/validate