QR Code to 2FA Secret Key
Upload, paste or scan a two-factor setup QR code and read the secret key hidden inside it. The image never leaves your device — decoding happens entirely in this browser tab.
Drop a QR image here, or paste one with Ctrl+V
Nothing is uploaded, logged or stored. Close the tab and the key is gone. Treat any secret key you extract like a password — anyone holding it can generate your login codes.
What this tool does
When a website turns on two-factor authentication it shows you a QR code. That image is not magic — it is a plain text string called an otpauth URI, and inside it sits your secret key. This tool reads the image, pulls out that string, and shows you every field it contains.
You would use it when you have a screenshot or photo of a setup QR code but no longer have the page that produced it, when you want to check which account a saved QR belongs to before importing it, or when you need the text key so you can store it in a password manager instead of relying on one phone.
What the fields mean
- Secret key — the Base32 string everything else is derived from. This is the sensitive part.
- Issuer and account — labels only. They tell your app which entry is which and have no effect on the codes produced.
- Type — almost always TOTP (time-based). HOTP is counter-based and needs an app that tracks state.
- Algorithm, digits, period — nearly every service uses SHA1, 6 digits and 30 seconds. If a QR specifies something else, a generator that ignores these fields will produce codes the server rejects.
Frequently asked questions
Is my QR code image uploaded anywhere?
No. The decoding runs in JavaScript inside your browser tab. Your image is drawn onto a canvas in memory and read back as pixels; no network request carries it anywhere. You can verify this by loading this page, disconnecting from the internet, and then decoding an image — it still works.
Why does it say the key is not valid Base32?
Base32 secrets use only the letters A to Z and the digits 2 to 7. The digits 0, 1 and 8 are excluded on purpose, because they are easily confused with O, I and B. If your extracted string contains them, you have probably scanned something that is not a 2FA setup code.
My QR is a Google Authenticator export — why will it not decode?
Google Authenticator’s Export accounts feature produces an otpauth-migration:// QR that packs many accounts into a compressed binary payload rather than a readable URI. This tool reads standard single-account setup codes. To move accounts one at a time, see our guide on transferring Google Authenticator to a new phone.
The camera button does nothing.
Browsers only grant camera access on secure origins and only after you approve the permission prompt. If you dismissed the prompt, reset the site permission in your browser’s address-bar menu. Uploading a screenshot works just as well and avoids the permission entirely.
What should I do with the key once I have it?
Store it in an encrypted password manager, or write it down and keep it somewhere physically secure. Do not leave it in a screenshot in your photo roll, in a plain notes app, or in a chat message to yourself — anyone who reads it can generate your codes. See 2FA backup codes: where to store them safely.
Related tools and guides
- 2FA QR Code Generator — the reverse: turn a secret key back into a scannable QR.
- 2FA Clock Checker — find out whether your device clock is why your codes fail.
- 2FA Live Code Generator — paste a key, get the six digits.
- How to enter a 2FA setup key manually
- What is a TOTP code?