OneTaskBy Tim King · Updated
otpauth URI Decoder
Issuer, Secret, Digits and Period Read From a 2FA Setup Link, Plus Compatibility Warnings
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the otpauth URI Decoder works
Paste an otpauth:// link into this otpauth URI decoder to see the issuer, account name, secret,
algorithm, digit count and period it carries. It also points out the mistakes that make authenticator
apps reject a setup code or show it under the wrong name.
What the otpauth URI decoder reads
Every two-factor QR code holds a single line of text in the Key URI Format Google published for
Authenticator. It looks like otpauth://totp/Issuer:account?secret=...&issuer=Issuer. The type is
totp or hotp, the label names the account, and the query string carries the secret in base32 plus
optional algorithm, digits, period and, for HOTP, counter.
Defaults matter
When a parameter is missing, apps assume SHA1, six digits and a 30-second period. The decoder marks each value that came from a default so you can tell what the URI actually says. Several apps silently ignore non-default values, so a URI asking for SHA-256 or eight digits may produce codes the server will not accept.
Issuer mistakes
The issuer can appear in two places — the label prefix and the issuer parameter. If they differ,
apps disagree about which to show. The decoder warns when they do, and when the secret is shorter than
the 16 bytes RFC 4226 asks for.
FAQ
How do I get the URI out of a QR code?
Scan the QR code with a generic scanner rather than an authenticator app, or use a QR decoder, and copy the text it shows. That text is the otpauth URI. Some password managers also let you export an entry's URI directly.
Is it safe to paste the URI here?
The URI is decoded in your browser and not sent anywhere. It does contain the secret, which lets anyone generate your codes, so clear it from your clipboard afterwards and never share a screenshot of the result.
Why is my account showing the wrong name in the app?
Most apps show the issuer followed by the label's account part. If the issuer is missing, or the label has no prefix, the app falls back to whatever it can find, which often means an email address alone. Set both the prefix and the parameter to the same value.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
TOTP Generator
Live two-factor codes from a base32 secret, with a countdown.
HOTP Generator
Counter-based one-time passwords from a base32 secret, listed in a table.
QR Code Generator
QR codes for links, Wi-Fi, contact cards and more, as a PNG.
URL Query Parser
Split a URL into a readable table of parameters.
TOTP QR Code Generator
Authenticator app setup QR codes from a secret, issuer and account.