Short answer: Every 2FA QR code has a text version hiding behind a link that says “Can’t scan the barcode?”, “Enter this text code”, or “Set up manually”. Tap it to reveal a string of letters and numbers, then in your authenticator app choose Add account → Enter a setup key, paste it in, set the type to Time-based, and save. The result is identical to scanning.
When you need the manual method
Four situations, and the first is by far the most common:
- You are setting up 2FA on the same phone that is displaying the QR code. You cannot photograph your own screen with its own camera. This trips up everyone at least once.
- Your camera is broken, blocked by policy, or the app has no camera permission.
- The code will not scan — low screen brightness, a dirty or cracked lens, a small or badly rendered code, or a dark-mode page that inverts the code’s contrast.
- You are adding the same account to a second device as a deliberate backup.
Step 1: Find the setup key
On the page showing the QR code, look for a link or small text underneath it. Wording varies by service:
- Google: Can’t scan it?
- Amazon: Can’t scan the barcode?
- Microsoft: I can’t scan the image
- GitHub: enter this text code
- Facebook / Instagram: the key is shown directly beneath the code, tap to copy
- Others: Set up manually, Enter code manually, Show secret key
What appears is a string of 16 to 32 characters, usually uppercase letters A–Z and digits 2–7, sometimes shown in groups of four. That is your secret key — the same data the QR code encodes, just written out.
Some services also show an account name and issuer alongside it. Note them if so; they only affect how the entry is labelled in your app, not whether the codes work.
Step 2: Add it to your authenticator app
Google Authenticator: tap + → Enter a setup key → type an account name → paste the key → set “Type of key” to Time based → Add.
Microsoft Authenticator: tap + → Other account → Or enter code manually → enter an account name and the key.
Authy: Add Account → Enter key manually → paste → choose 6 digits and 30 seconds unless told otherwise.
Aegis: + → Enter manually → paste into Secret, leave type TOTP, algorithm SHA1, digits 6, period 30.
2FAS: + → Enter key manually → service name and key.
Bitwarden / 1Password / Proton Pass: edit the login item and paste the key into the authenticator or one-time password field. See password managers with built-in TOTP for whether that is a good idea for a given account.
Step 3: Get the settings right
Nearly every service uses the same defaults, and nearly every app assumes them:
- Type: Time-based (TOTP), not counter-based (HOTP)
- Algorithm: SHA1
- Digits: 6
- Period: 30 seconds
If your app asks and the service did not specify, use exactly these. The rare exceptions announce themselves — Steam uses a five-character alphanumeric code, and a handful of enterprise systems use SHA256 or 60-second windows. Our explainer on how TOTP codes work covers what each of these parameters actually does.
Step 4: Confirm before you close the page
Your app should now show a six-digit code refreshing every 30 seconds. Type it into the service’s confirmation box.
Do not close the setup page until the service confirms it worked. If you navigate away, most services discard the key and you have to start over — and some leave the account in a half-enabled state.
Once confirmed, save your backup codes. This is the step people skip, and it is the one that matters if the phone is ever lost.
Handling the secret key safely
This is where manual entry carries a risk that scanning does not: the key now exists as copyable text, which means it can end up in places you did not intend.
- Do not screenshot it, and do not screenshot the QR code either. Camera rolls sync to the cloud.
- Do not email it to yourself or paste it into a notes app that syncs to an account protected by the same password.
- Do not leave it in your clipboard. Copy something else afterwards — clipboard history is readable by other apps on some systems.
- Do not paste it into a random “TOTP generator” website that processes keys on its server. Anyone holding your secret key can generate valid codes forever, invisibly. We cover how to judge these tools in is an online 2FA code generator safe?
Anyone with the key has permanent access to your second factor. Treat it like the password itself.
The one genuinely useful trick
While the setup key or QR code is on screen, you can add it to two devices at once — your phone and a tablet, or two different authenticator apps. Both will generate identical codes, forever, independently.
This is the cleanest form of backup: no export files, no cloud sync, no dependency on the app vendor. The catch is that it only works at setup time. Once you close that page, the key is gone and your only options are backup codes or a full re-enrolment.
Do it for the accounts you cannot afford to lose. It also makes moving to a new phone trivial later — though if you skipped this step, our guide on transferring Google Authenticator to a new phone covers the migration path.
Frequently asked questions
Is entering the key manually less secure than scanning?
The resulting token is identical — same secret, same codes. The only difference is exposure: manual entry puts the key on your clipboard and possibly your screen for longer. Handle it carefully and there is no security difference.
What if the service doesn’t show a text key at all?
A few only display a QR code. Options: display it on a second screen and scan from your phone; use a desktop authenticator or password manager browser extension that can read a code from the screen; or use an app that can import a QR image from a file — though that means saving the image, which you should delete immediately afterwards.
Why is my code rejected after manual entry?
Three usual causes: a typo (0 and O, 1 and l are the classics — copy and paste rather than typing), the wrong type selected (counter-based instead of time-based), or clock drift on your phone. Turn on automatic network time and see why 2FA codes get rejected.
Do spaces in the key matter?
No. Keys are often displayed in groups of four for readability. Most apps strip spaces automatically; if yours complains, remove them. Case usually does not matter either, but enter it as shown.
Can I use the same setup key on multiple devices?
Yes, and it is a good idea for important accounts. Every device with that key generates the same code at the same time. Just remember that each additional copy is another place the secret can be stolen from.
What is the string that starts with otpauth://?
That is the full URI encoded inside the QR code, containing the secret plus the issuer, algorithm, digits and period. Some apps let you paste it directly, which is more reliable than manual entry because every parameter comes along with it.
The bottom line
Manual entry is not a workaround, it is a fully supported path that produces exactly the same token. Find the “can’t scan” link, paste the key, set it to time-based, confirm before closing the page, and save your backup codes. And while that key is still on screen, take thirty seconds to add it to a second device — that is the backup you will be grateful for.
Want to check a key generates the codes you expect? Our online 2FA code generator runs entirely in your browser and never transmits your key.
4 Responses