AltF Authenticator

otpauth:// QR code generator

Fill in the issuer, account name and settings, and the page builds a standard otpauth://totp/ link and draws it as a QR code that authenticator apps can scan. Everything is made in your browser, so the secret is not sent to a server. It is meant for developers and site owners testing or demonstrating 2FA enrolment.

  • Free, no sign-up
  • Secrets stay in your browser
  • RFC 6238 self-test built in
  • Works on mobile

The otpauth:// format

Authenticator apps read a link of the form otpauth://totp/Issuer:account?secret=BASE32&issuer=Issuer&algorithm=SHA1&digits=6&period=30. The label after totp/ names the account, the secret is the Base32 shared key, and the remaining parameters describe how codes are made. This format started as Google Authenticator's key URI format and is now read by almost every authenticator app.

Fields and what to put in them

  • Issuer: your product or company name. Put it both in the label prefix and in the issuer parameter.
  • Account: the user's email or username, so people can tell accounts apart.
  • Secret: a random Base32 key. Use the Setup tab's generator for 160 random bits.
  • Algorithm, digits, period: keep SHA1, 6 and 30 for the widest compatibility.

Compatibility advice

Some versions of Google Authenticator have ignored the algorithm, digits and period parameters and used the defaults instead, which produces codes your server will reject. Unless you control the apps your users run, stick to SHA1, 6 digits and 30 seconds. Always show the Base32 secret as text next to the QR code for people who cannot scan.

Handle the QR code like a password

Anyone who scans or photographs the QR code can make the same codes forever. Show it only over HTTPS, only to the signed-in user, and only during enrolment. Ask the user to type a current code to confirm before you turn 2FA on.

otpauth:// QR code generator: questions and answers

Should the issuer go in the label or the parameter?

Both. Older apps read the prefix in the label and newer ones prefer the issuer parameter. Make them identical and URL-encode spaces.

Can I use this QR code to protect a real account?

Only if your own app or server stores the same secret and checks codes against it. This page does not enrol anything with any service.

Is the QR code made on a server?

No. The QR code is drawn in your browser, so the secret it contains is not uploaded.

Does the otpauth link support HOTP?

Yes. The format allows otpauth://hotp/ with a counter parameter instead of a period, but most websites use TOTP.

Authenticator tools and 2FA guides

All authenticator toolsThe full studio: live codes, setup, verify, HOTP, export decoder, backup codes, clock check and self-test.TOTP code generatorGenerate TOTP 2FA codes from a Base32 secret, otpauth:// link or QR image. SHA-1, SHA-256 or SHA-512, 6 or 8 digits, calculated in your browser.TOTP secret key generatorGenerate a random 160-bit Base32 TOTP secret with your browser's secure random number generator, plus the otpauth link and QR code. Nothing is sent.TOTP code verifierCheck whether a 2FA code matches a secret within a window of time steps, and see which step matched and the clock drift that implies. Runs in your browser.HOTP generatorGenerate HOTP counter-based one-time passwords per RFC 4226 from a Base32 secret and any counter value. Includes the RFC test values. Runs in your browser.Google Authenticator export decoderDecode a Google Authenticator Export accounts QR (otpauth-migration://) into standard otpauth links and secrets, locally in your browser. Nothing uploaded.2FA backup codesGenerate random recovery codes, download or print them, and learn where to store your real 2FA backup codes so a lost phone does not lock you out.2FA code not workingWhy your authenticator code is rejected and how to fix it: check your device clock, the secret, the account and non-default settings. Free clock check.RFC 6238 test vectorsThe 18 RFC 6238 Appendix B TOTP test vectors for SHA-1, SHA-256 and SHA-512, with seeds, times and expected 8-digit codes, run live in your browser.

Guides

What is TOTP?What TOTP is, how authenticator apps make 6-digit codes from a secret and the time, how it compares with SMS and passkeys, and what it protects against.Lost phone 2FA recoveryLost or reset the phone with your authenticator app? Steps to get back into accounts with backup codes or recovery, then set 2FA up safely again.SMS vs authenticator appSMS codes, authenticator apps, passkeys and security keys compared: what each protects against, the risks of SIM swap and phishing, and what to choose.

AltFTool never receives your secrets or codes. The only network request any tab makes is the clock check, which asks AltFTool's server for the time and carries nothing else.