How to Decode a 2FA Authenticator QR Code

You’re migrating to a new phone and your old authenticator app doesn’t have an export button, or a client handed you a “scan this to set up 2FA” QR code and you want to know what account it’s actually tied to before you scan it into a device. Either way, you’re staring at a QR code that’s really just a wrapper around a text string, and you have no easy way to see what’s inside it without pointing a phone camera at it and hoping the app that opens is trustworthy.

That’s the annoying part. A two-factor QR code isn’t a mystery — it’s a plain otpauth:// URI encoded as an image — but almost nothing lets you read that URI directly. You either scan blind with whatever authenticator app you already trust, or you dig up a generic QR reader that just dumps raw text you then have to parse by hand.

What’s actually inside a 2FA QR code

An otpauth:// URI is a small, structured piece of text: a type (totp for time-based codes, the common case), an issuer and account label, and a handful of parameters — the shared secret, the hashing algorithm, the number of digits, and how often the code refreshes. Scanning the QR code with an authenticator app just reads this URI and stores the secret so it can generate matching six-digit codes going forward.

Nothing about that process is secret-sauce. If you can read the URI, you can see exactly which account it belongs to, which secret it uses, and reproduce the same code the app would generate.

Why people get stuck here

• No visibility before scanning. Most QR scanners just launch a URL or hand the string to whatever app claims the otpauth:// scheme, with no preview of what’s inside.
• Losing access to the original app. If you never saved the setup QR code or backup codes, and the authenticator app is gone, you can be locked out of an account with no easy recovery path.
• Verifying a code from IT or a vendor. When someone sends you a QR code for a shared or service account, you often want to confirm the issuer and account name match what you expect before trusting it.
• Testing your own TOTP implementation. If you’re building or debugging 2FA in your own app, you need a fast way to confirm a generated URI actually produces the codes you expect.

What a good otpauth decoder looks like

Reads the raw URI, not just the image

You should be able to paste an otpauth:// string directly — not just upload a QR image — since the string is often what you actually have (copied from a setup page, extracted from a backup file, or shared as text).

Shows every parameter plainly

Issuer, account label, secret, digit count, algorithm, and refresh interval should all be visible and labeled, not buried in a single decoded blob you have to re-parse.

Generates a live preview code

The real test of whether a URI is valid and correctly formed is whether it produces a live, refreshing code that matches what an authenticator app would show for the same secret.

Common mistakes to avoid

• Scanning an unfamiliar 2FA QR code with your primary authenticator app before confirming what account and issuer it’s actually for.
• Assuming a QR code that “looks like” a login QR is the same as one for two-factor setup — they’re different URI schemes entirely.
• Storing a decoded secret in plain text somewhere insecure just to check it once; treat any TOTP secret as a live credential.
• Losing the only copy of a setup QR code without saving a backup code or writing down the raw secret somewhere safe.
• Assuming all authenticator codes use the same digit count or refresh interval — some services use 8 digits or a 60-second window instead of the common 6-digit, 30-second default.

How to do it with 2FA QR Decoder

Online Tool Store’s 2FA QR Decoder reads an otpauth:// URI entirely in your browser and never sends the secret anywhere.

1. Open the 2FA QR Decoder tool.
2. Paste the otpauth:// URI you want to inspect.
3. Review the decoded account name, issuer, secret, and other parameters.
4. Watch the live, refreshing TOTP code generated from that secret to confirm it’s valid.

Because the decoding happens locally, it’s a reasonable way to sanity-check a 2FA secret before you commit to storing it in a password manager or authenticator app.

Frequently asked questions

Is it safe to paste a TOTP secret into a web tool?

Only if the tool processes it locally in your browser rather than sending it to a server — check that before pasting any real account secret anywhere, including here. Treat every TOTP secret like a password.

What’s the difference between otpauth and a login QR code?

An otpauth:// URI is specifically for setting up time-based or counter-based one-time codes in an authenticator app. A login QR code (like the kind messaging apps use to sign in on a new device) uses a completely different, app-specific format and isn’t decodable the same way.

Can I use a decoded secret to set up a second authenticator app?

Yes — the secret and parameters inside the URI are exactly what any compliant authenticator app needs to generate matching codes, so you can add the same account to a second device or app using the same values.

Final thought

Treat a 2FA QR code the same way you’d treat a password: worth inspecting before you trust it, and worth handling somewhere that doesn’t ship the secret off your device. A quick local decode answers “what account is this actually for?” before you scan blind.

Try the free 2FA QR Decoder tool