OneTaskBy Tim King · Updated
TOTP QR Code Generator
otpauth QR Codes for Google Authenticator and Authy, Downloadable as PNG or SVG
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the TOTP QR Code Generator works
This TOTP QR code generator builds the setup code that authenticator apps scan when you turn on two-factor sign-in. Enter the Base32 secret, the service name and the account, and it encodes them as an otpauth URI in a QR code, ready to download as PNG or SVG. Nothing leaves your browser.
What the TOTP QR code generator encodes
The QR code holds a single otpauth URI, such as
otpauth://totp/Acme:jo@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Acme. The label shows the issuer and
account in the app, and the issuer parameter is repeated so every app groups the entry correctly. The
secret is the shared key from which the app and the server both compute the same six-digit code every
thirty seconds, as defined in RFC 6238.
Keep to the defaults
Google Authenticator and several other apps ignore the algorithm, digits and period parameters, or reject unusual values, and silently fall back to SHA-1, six digits and thirty seconds. If your server uses anything else, users with those apps will get codes that never match. Only change them when you know every app your users rely on supports it.
FAQ
Where do I get the secret?
Your server generates it, typically 20 random bytes encoded as Base32, and stores it against the user's account. For testing, the TOTP generator on this site accepts any Base32 secret and shows the codes it produces, so you can check that your server and the app agree.
Is it safe to generate a real setup code here?
The page works entirely in your browser and sends nothing, but anyone who sees the QR code or the secret can generate your codes. Treat it like a password: do not screenshot it into shared places, and clear the page once the app has scanned it.
Why does my app show the wrong name?
Apps take the name from the issuer and the label before the colon. Make sure the issuer contains no colon, and that it matches what users expect to see, such as your product name. Some older apps only read the label, which is why both are included.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
TOTP Generator
Live two-factor codes from a base32 secret, with a countdown.
Otpauth URI Decoder
Break an otpauth:// 2FA link into issuer, secret and settings.
Backup Code Generator
Random two-factor recovery codes, grouped for easy reading.
QR Code Generator
QR codes for links, Wi-Fi, contact cards and more, as a PNG.
QR Code Decoder
Read a QR code from an image and check it before opening.