OTPAuth URI Builder
Build a valid otpauth:// URI and QR code for 2FA setup. Enter your secret key and account details — instantly generate a scannable QR code for any authenticator app.
📱 Universal Format
The otpauth:// URI format works with every major authenticator app — Google Authenticator, Authy, Microsoft, and more.
🔒 100% Private
Your secret key and QR code are generated entirely in your browser. Nothing is sent to any server or stored anywhere.
⚡ Instant QR
Click "Show QR" to generate a scannable QR code that users can scan directly with their authenticator app.
Frequently Asked Questions
What is an otpauth:// URI?
An otpauth:// URI is a standardised format for encoding all the information needed to configure 2FA in a single string. It includes the secret key, account name, issuer, number of digits, period, and algorithm. When encoded as a QR code, any authenticator app can scan it to set up 2FA automatically.
What parameters do I need?
The minimum required is the account name and secret key. The issuer (your app/service name) is strongly recommended as it labels the entry in the user's authenticator app. Digits (6 is standard), period (30 seconds is standard), and algorithm (SHA1 is universal) can be left at defaults unless you have a specific reason to change them.
Where do I get the secret key?
You generate it when implementing 2FA in your application. Use our TOTP Secret Key Generator to create a cryptographically secure secret key. Store it securely in your database, associated with the user's account.
Should I use SHA1 or SHA256?
Use SHA1 unless you have a specific reason not to. SHA1 is the universal standard for TOTP and is supported by every authenticator app. SHA256 is supported by fewer apps and provides no meaningful security improvement for TOTP given the short code length.
Which characters must be percent-encoded in an otpauth URI?
The label (issuer and account name) and the issuer parameter are percent-encoded: spaces become %20, the : between issuer and account becomes %3A, and @ becomes %40. The secret itself never needs encoding because Base32 only uses the characters A–Z and 2–7. This tool encodes these fields automatically.
What is the difference between otpauth://totp and otpauth://hotp?
totp is time-based: the code changes every period seconds (normally 30), which is what nearly every modern service uses. hotp is counter-based: the code changes only when the user requests a new one, and the URI adds a counter parameter. Unless you specifically need counter-based codes, use totp.
Why does the app show a different account name than I expected?
Authenticator apps display the label portion of the URI, which has the form Issuer:Account, and many apps also read the separate issuer parameter to group entries. If you omit the issuer, the app simply shows the account name alone. Keep the label and issuer field consistent to avoid duplicate-looking entries when users add multiple accounts from the same service.
Can users change the algorithm after scanning?
No. The app stores the algorithm, digits, and period exactly as they appear in the URI at scan time. If you change any of these parameters on your server later, generated codes will stop matching and the user must re-enroll with a fresh QR code. Choose parameters once and keep them stable.
How to use the otpauth URI builder
- Enter the issuer. Type your service name, for example "MyApp". This becomes the group heading users see in their authenticator app, so keep it short and consistent across all of your accounts.
- Enter the account name. Use the user's email address or username — this labels the individual entry. Together with the issuer it forms the URI label
MyApp:user@example.com. - Paste the secret key. The Base32 secret generated when you set up 2FA — use the TOTP Secret Key Generator if you need a fresh one. The URI is built and updated live as you type.
- Confirm the parameters. 6 digits, a 30-second period, and SHA1 are the standard values every authenticator app supports. Only change them if your server actually uses different settings.
- Copy or show the QR code. Press "Copy URI" to embed the URI in your own QR generator, or press "Show QR" to render a scannable code directly in the page. The user scans it once with their authenticator app and the account is added.
How the otpauth URI format works
Every otpauth URI follows the same shape: otpauth://totp/Issuer:Account?secret=BASE32&issuer=Issuer&algorithm=SHA1&digits=6&period=30. The scheme (otpauth), the type (totp), the label, and the query parameters together carry everything the authenticator app needs to begin generating codes with no further input from the user.
The secret parameter is the only required piece of data; the rest have defaults (SHA1, 6 digits, 30 seconds) that most apps assume when they are missing. The issuer is duplicated in the label and as a separate parameter on purpose: the label determines what the user sees, while the issuer parameter helps apps group entries and display a friendly name. Percent-encoding rules matter here — any character outside the unreserved set in the label or issuer must be escaped, which is why this tool encodes the fields for you rather than leaving the raw text in the URI.
Because the whole URI is generated in your browser, the secret never travels over the network. When you hand the URI to your own QR code generator or embed it in an enrollment email, make sure you deliver it over a secure channel — the secret inside it is the same secret used to verify every future login.