📱 QR Code Generator for 2FA Secrets

What Is a TOTP Secret and Why Does It Need a QR Code?

When a website says "enable two-factor authentication," it is handing you a secret key — a short string of random letters and numbers, maybe something like JBSWY3DPEHPK3PXP. That string is the seed for a tiny math formula that your authenticator app and the server both know. Every 30 seconds, both sides run the formula, produce the same six-digit code, and if yours matches theirs, they know it is really you.

The problem is that typing a 16-to-32-character random string into a phone keyboard is painful and error-prone. One mistyped character and your authenticator app will never produce the right codes. So websites figured out a smarter way: they encode the secret inside a QR code. You open your authenticator app, point your camera, and the whole setup happens in under a second with no typing at all.

The format they use is called an otpauth:// URL. It looks like this:

otpauth://totp/GitHub:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=GitHub

Every TOTP authenticator app on the planet — Google Authenticator, Authy, Microsoft Authenticator, Aegis, Bitwarden — understands this format. When you scan a QR code during 2FA setup, you are scanning a QR code that contains exactly this kind of URL.

When Would You Need to Generate One Yourself?

Most of the time a website generates this QR for you on screen. But there are real situations where you end up with just the raw secret and need to make your own code:

Migrating to a new authenticator app. You switched from Google Authenticator to Authy (or vice versa), but some of your old accounts only gave you the secret key as text, not a scannable image. You need to re-enroll those accounts in the new app.

Backup and recovery. You store your 2FA seeds in a password manager or an encrypted file. When you set up a new phone, you want to scan your own saved secret instead of going through each service's 2FA reset flow.

Self-hosted or home-lab services. If you run your own services — a Nextcloud instance, a Proxmox server, a home automation panel — you might generate TOTP secrets programmatically and then need a convenient way to enroll a phone without copy-pasting.

Lost device recovery. Your phone died and you kept the bare secret key but not a backup QR. Rather than revoking and re-enabling 2FA on every account (which can lock you out during the process), you can regenerate the QR from your saved secret.

Why "Offline" Matters So Much Here

Think about what you are about to hand to a QR generator: the single piece of information that lets anyone log into your accounts as you. If you paste your TOTP secret into a random website that pings a server to draw the QR, that secret just traveled over the internet to a computer you do not control. It may sit in a request log, a database, or a analytics pipeline. That one keystroke defeats the entire point of two-factor authentication.

This tool generates QR codes entirely inside your browser using pure JavaScript. There is no fetch request, no API call, no image generated on a remote server. The QR drawing logic implements the full QR code specification — Galois Field arithmetic, Reed-Solomon error correction, zigzag data placement, finder patterns, format information strips — all in vanilla JavaScript running locally on your machine. You can disconnect from the internet before using it and it will work just the same.

What Is Inside the Generated QR Code?

The QR code this tool creates contains the otpauth://totp/ URL constructed from your inputs. The URL carries four key pieces of information that your authenticator app reads on scan:

The secret — your Base32-encoded seed. This is what drives the HMAC-SHA1 calculation that produces the six-digit code. It must be kept private.

The issuer — the name of the service (GitHub, AWS, your company name). Authenticator apps display this so you know which account each entry belongs to.

The account label — usually your email address or username for that service. Shown alongside the issuer in the app list.

The parameters — algorithm (SHA1 is the universal default), digits (6 is standard), and period (30 seconds is the TOTP standard). These tell the app how to compute codes.

How to Read the Base32 Secret

If you have never looked closely at a TOTP secret before, the format might seem odd. Base32 uses only 32 characters: the letters A through Z and the digits 2 through 7. It excludes 0, 1, 8, and 9 because they look too much like O, I, B, and G in small fonts — confusion that would ruin manual entry.

You might see the secret padded with equal signs at the end (like JBSWY3DPEHPK3PXP====). That is standard Base32 padding and this tool strips it automatically. You might also see it with spaces every 4 characters for readability — those are stripped too. Lowercase is fine; the tool converts to uppercase internally.

The one thing to double-check: make sure you are copying the secret key and not the six-digit code itself. The secret is static and usually 16–32 characters long. The six-digit code changes every 30 seconds and is useless for enrollment.

After Scanning: What the Authenticator App Does

The moment your authenticator app reads the QR code, it extracts the secret and stores it in its local encrypted database — never sending it anywhere. From that point on, every 30 seconds the app takes the current Unix timestamp, divides it by 30 to get a counter, hashes it with your secret using HMAC-SHA1, and picks 6 digits out of the result. The server runs the exact same calculation. If the digits match, you are in.

The QR code itself is now no longer needed. The secret is what matters, and it lives only in your authenticator app and on the server. Once enrolled, you can close this page, clear the QR image, and the security of your account depends entirely on that secret staying private — which is why generating the QR offline (as this tool does) is the only safe approach.

Tips for Safe Use

Use this tool over an HTTPS connection even though generation happens locally — this prevents a network attacker from swapping the page itself with a version that does exfiltrate your secret. After generating, close the browser tab before sharing your screen. If you save the QR as a PNG for backup purposes, encrypt that file or store it in a password manager's secure notes, treating it with the same care as the master password itself. Never screenshot a QR code displayed on screen and then upload that screenshot to a cloud service without encryption — a photo of a 2FA QR code grants complete account access to whoever finds it.