GLOSSARY

What is an otpauth:// URI?

The otpauth:// URI is what a 2FA QR code encodes — issuer, account, and secret. Learn its format and generate one free.

Open the TOTP generator →All free tools

When you scan a 2FA QR code, your authenticator app is really reading an otpauth:// URI — a compact string that carries the shared secret and settings needed to generate TOTP codes.

The URI format

A typical URI looks like otpauth://totp/Issuer:account?secret=BASE32&issuer=Issuer&period=30&digits=6&algorithm=SHA1. The type (totp), a label (issuer and account), and query parameters (the Base32 secret plus period, digits, and algorithm) fully describe how to compute the codes.

Why it is a QR code

Rather than typing a long Base32 secret by hand, the service renders the otpauth URI as a QR code. Your app scans it, stores the secret, and immediately starts producing matching codes. You can also enter the secret manually if you cannot scan.

Try it now — free, no signup

Use the TOTP generator in your browser. Then, when you need it at scale with an API key and higher limits, grab the full Eveses API.

Open the TOTP generator →Sign up for the full API

FAQ

Can I generate an otpauth URI?›
Yes — our TOTP tool builds one from an issuer and account and renders the QR, so you can test scanning it with any authenticator app.
Is the secret inside the QR code?›
Yes — the Base32 secret is embedded in the otpauth URI the QR encodes, which is why the QR must be kept private.

Related

What is TOTP (Time-based One-Time Password)?TOTP is the 6-digit code your authenticator app shows for 2FA. Learn how time-based one-time passwords work, and generate or verify one free.What is Base32?Base32 encodes bytes using 32 case-insensitive characters — the format of 2FA secrets. Learn how it differs from Base64.How to set up TOTP two-factor authenticationSet up app-based two-factor authentication with TOTP. Step-by-step, plus a free tool to generate a secret, QR code, and verify codes.