Authenticator App - Novaz

2FA QR Code Decoder

See what's inside a two-factor authentication QR code: the service, the account, the secret key and the code settings. It also unpacks Google Authenticator export codes, and it runs entirely in your browser.

Drop a QR code image here, paste a screenshot, or

Decoded on this device. Nothing is uploaded.

What's inside a 2FA QR code

When a site shows a QR code to set up an authenticator app, the code holds a link like otpauth://totp/GitHub:octocat?secret=JBSWY3DPEHPK3PXP&issuer=GitHub. The secret key is shared by the site and your app; both use it with the current time to produce the same 6-digit code every 30 seconds. Some services change the defaults with algorithm, digits or period, and the decoder shows those too.

Moving accounts out of Google Authenticator

Google Authenticator's "Transfer accounts" screen makes one or more QR codes that start with otpauth-migration://, each holding several accounts; a big export is split across more than one QR code. Decode each QR code here to see every account and copy a standard otpauth:// link for it.

Add the accounts to Authenticator App - Novaz

Authenticator App - Novaz can scan these QR codes directly, or import a screenshot of them, so you rarely need the secret by hand. See importing from another authenticator app and adding an account with a setup key.

Get Authenticator App - Novaz

Frequently asked questions

Is it safe to decode my 2FA QR code here?
The QR code is read by JavaScript on this page and never sent anywhere: there is no upload and no server call. Still, a 2FA secret is as sensitive as a password, so decode it on your own device and don't share screenshots of the result.
What is an otpauth:// link?
It's the standard format inside almost every 2FA setup QR code. It holds the account name, the service (issuer), the secret key in base32, and optional settings: the hash algorithm, the number of digits and how often the code changes.
Can I read a Google Authenticator export QR code?
Yes. Google Authenticator's "Transfer accounts" export uses an otpauth-migration:// link that packs several accounts into one QR code. This tool unpacks every account in it. Big exports are split across several QR codes, so decode each one.
Why would I need the secret key?
To move an account to another authenticator app when a direct import isn't available, or to keep an offline backup. Anyone with the secret can generate your codes, so store it as carefully as a password.