QR code vs setup key: two ways to add a 2FA account

When you turn on two-factor authentication, the service shows you a QR code and, usually, a line of letters and numbers labelled "setup key" or "manual entry key." They're two ways of doing exactly the same thing.

They both carry the same secret

Both options hand your authenticator app the same shared secret — the seed it uses to generate your TOTP codes. The QR code is just that secret packaged as an image so your camera can read it instantly. The setup key is the same secret written out so you can type it.

When to scan the QR code

This is the default and the easiest path. Open your authenticator app, choose "add account," point the camera at the QR code, and you're done. Use this whenever you're setting up 2FA on a computer screen with a separate phone in hand.

When to use the setup key instead

Type the key manually when:

• You're enabling 2FA on the same phone that has your authenticator app, so there's no second screen to scan.
• The camera won't focus or the code won't scan.
• You're adding the account to a second device for backup.

One important warning

Whichever you use, that secret is the key to your account. Don't screenshot the QR code into your camera roll or paste the setup key into a note or chat. Add it to your authenticator, confirm a code works, and move on.

See how setup looks for popular services →