2FA QR Code Generator

About This Tool

The 2FA QR Code Generator creates a standard otpauth://totp/ URI and renders it as a scannable QR code. This format is recognized by every TOTP authenticator app, including Google Authenticator, Authy, Microsoft Authenticator, and Aegis. The QR code is generated entirely in your browser, and your secret key is never transmitted to any server. Use it when setting up 2FA on a new device or re-enrolling after losing your authenticator.

How to Use

1. Enter the Issuer, the website or app name (e.g. "GitHub").
2. Enter the Account, usually your email address for that service.
3. Paste your Base32 Secret Key from the service's 2FA settings page.
4. Click Generate QR Code and scan it with your authenticator app.
5. Optionally, click Download PNG to save the QR code image.

Common Use Cases

• Re-enrolling a lost or replaced phone: paste the secret key you saved when 2FA was first set up to regenerate the same QR code, without waiting on the service's support team to reset your account.
• Self-hosted servers: tools like Nextcloud, Vaultwarden, pfSense, and GitLab CE sometimes only display a plain text secret during setup instead of a QR code. Paste that secret here to get a scannable code for your phone.
• Sharing setup instructions with a teammate: if the original service's QR code has already been dismissed, regenerate it from the saved secret during a screen share instead of resetting 2FA entirely.
• Adding one account to a second device: generate a fresh QR from a saved secret to add the same authenticator entry to a spare phone or tablet as a backup.
• Testing your own TOTP implementation: point a QR code at a known secret to confirm the codes your custom authentication code produces match what a real authenticator app generates.

Understanding the otpauth:// URI Format

The QR code encodes a URI in the format otpauth://totp/Issuer:Account?secret=BASE32SECRET&issuer=Issuer&algorithm=SHA1&digits=6&period=30. The algorithm, digits, and period parameters are technically configurable per RFC 6238, but in practice almost every consumer authenticator app (Google Authenticator, Authy, Microsoft Authenticator) hardcodes SHA1, 6 digits, and a 30 second period and ignores anything else. If you are building your own server and want SHA256 or SHA512 for extra security, confirm your users' authenticator apps actually support it first, since a mismatch produces codes that never validate.

Troubleshooting

"Invalid Base32 secret key" error: the field only accepts A to Z and 2 to 7. Check for accidentally copied spaces, hyphens, or an equals sign padding character, and make sure the string is at least 8 characters long.

The QR scans fine but the authenticator app shows the wrong codes: this almost always means the secret was mistyped or truncated when it was copied. Regenerate the QR code directly from the original setup page if possible, rather than retyping the secret by hand.

The Download PNG button does nothing: some ad blockers or strict browser privacy modes can interfere with canvas image export. Check the browser console for errors, or try right-clicking the QR code image and choosing "Save Image As" instead.

The page shows "QR library failed to load": the QR rendering library loads from the jsdelivr CDN. A restrictive corporate firewall or network-level ad blocker can block this. Try a different network or disable the blocker for this page.

Frequently Asked Questions