2FA QR Code Scanner
Upload a screenshot of your 2FA QR code or use your camera to scan it. Extracts the secret key instantly so you can use it with our TOTP generator — no app needed.
🔒 100% Private
QR code scanning happens entirely in your browser using JavaScript. No image is ever uploaded to any server.
📱 What QR Codes Work?
Any 2FA setup QR code that generates an otpauth://totp/ URL — from any service that supports TOTP authentication.
💡 When to Use This
When you have a 2FA QR code screenshot but no authenticator app installed. Extract the secret and generate codes directly here.
Frequently Asked Questions
What is a 2FA QR code?
A 2FA QR code encodes an otpauth:// URL containing your TOTP secret key, issuer name, and account label. Services show this QR code when you enable two-factor authentication. You scan it with an authenticator app to start generating time-based codes. The QR code is only shown once during setup for security reasons.
How do I get a new QR code if I already set up 2FA?
Most services never show the same QR code twice. If you lost access to your authenticator app, go to your account security settings, disable 2FA, then re-enable it. This generates a fresh QR code and secret key. Before doing this, make sure you have recovery codes or an alternative sign-in method available.
Is it safe to scan a QR code here?
Yes. All scanning happens in your browser using JavaScript — nothing is uploaded to any server. The jsQR library processes images entirely on the client side. Once you close the page, no trace of the decoded data remains. This is actually more private than cloud-synced authenticator apps.
Can I scan a QR code from my phone screen?
Open the QR code on one device and your camera on the other. For example, show the QR code on your phone and point your computer's camera at it. You can also take a screenshot on your phone, transfer it to your computer, and upload the image file.
What if the QR code is blurry or won't scan?
Use the highest resolution image available. Native screenshots work better than photos of a screen. Good lighting and high contrast between the QR code and its background are essential. Crop out excess white space around the code. For camera scanning, hold steady — the scan runs every 300 milliseconds so slight movement is fine.
Does this support all types of 2FA QR codes?
This scanner supports any QR code encoding an otpauth:// URL, which covers all TOTP-compatible services including Google, Microsoft, GitHub, Facebook, Instagram, Discord, Coinbase, Binance, and thousands more. Non-otpauth QR codes are still decoded and their raw content is displayed.
Does this tool store or log my scanned secrets?
No. The page has no database, no API calls, and no backend. Scanning, decoding, and display all happen in your browser session. Refreshing or closing the page erases all scanned data. If you use the link to our TOTP generator, the secret is passed via URL and processed client-side on the destination page as well.
Why won't my camera start?
Browsers only allow camera access on secure contexts (HTTPS or localhost) and only after you approve the permission prompt. If the camera stays off, check the site's permission settings in your browser, make sure another app isn't holding the webcam, and close unused tabs. As a fallback, the image upload path needs no permissions at all.
How to Scan a QR Code
This scanner works two ways: it reads your camera feed continuously, and it decodes image files you upload. Both paths run entirely in your browser with jsQR — no frame ever leaves your device, so 2FA secrets never pass through a server along the way.
- Via camera: click the camera button, approve the permission prompt, and hold the QR code steady in view. The scanner runs continuously and snaps the moment it reads the code.
- Via image upload: click Upload/choose the file with the QR code — a screenshot from your phone or a saved picture both work. Prefer native screenshots over photos of a screen; they are sharper and decode reliably.
- Check the result: raw encoded content is displayed immediately. If it checks out as a
otpauth://link, tap/click the accompanying button to jump to our TOTP generator with the secret pre-filled — you can generate codes there, then close this tab to discard the scanned copy. - Troubleshoot stubborn codes: more light always helps, keep the code flat and legible, and frame it inside the view finder with margin. For camera mode, hold still for a second — the scan loop needs a crisp frame or two.
Scanner Security: What to Trust Before You Scan
QR codes are convenient, but they are also an increasingly large attack surface. Attackers have slapped fake codes on parking meters, invoices, and login screens — the code itself can't hurt you, but the URL inside can take you to a phishing page or initiate a payment. Treat any on-screen code the same way you'd treat a suspicious link.
- Check the decoded value, not the picture. Before acting on any code, compare the plain text against the source: a 2FA setup code should always start with otpauth:// and token, the issuer should match the service that printed it.
- Never enter credentials or payment info from a QR code that wasn't printed by the service itself — especially when stuck on a stranger's printed sheet of an unattended screen.
- Treat forwarded codes with suspicion. A 2FA QR re-sent by chat or email attachment is often an attacker forwarding code they scanned themselves.
- Revoke and re-enroll if you scanned a 2FA setup QR from an unfamiliar source or an untrusted computer — regenerating a fresh secret takes two minutes and eliminates any exposure.