2FA QR Code Generator
Turn a TOTP secret key back into a scannable QR code so you can add it to Google Authenticator, Authy, Aegis, 2FAS, Bitwarden or any other app. Generated in your browser — the key is never sent anywhere.
Everything runs client-side. Do not screenshot the finished QR into a cloud photo library — a QR code is your secret key in a picture, and anyone who sees it can generate your codes.
When you would need this
Most people meet a 2FA QR code only once, at setup. But the QR is just a container: the real thing is a short Base32 secret key. If you saved that key and later want it back inside an authenticator app, you need a QR code again — and almost no service will show you the original one twice.
Typical situations where this helps:
- You kept the setup key in a password manager and are now setting up a new phone.
- You are moving from one authenticator app to another and the old app will not export.
- An app on your phone only accepts a scan and refuses manual key entry.
- You want a second device holding the same account, as a deliberate backup.
How to use it
- Paste your secret key. Spaces, dashes and lower case are all fine — they are normalised.
- Add the account name and issuer if you want the entry to be labelled properly in your app. These are cosmetic; they do not change the codes.
- Leave algorithm, digits and period alone unless the original service specified something unusual. Almost everything uses SHA1, 6 digits, 30 seconds.
- Generate, then scan with your authenticator app.
- Confirm it worked: the code your app shows should match the one our online generator produces from the same key at the same moment.
Frequently asked questions
Is my secret key sent to your server?
No. The QR is drawn in your browser by JavaScript running on this page. Nothing you type is transmitted, logged or stored. Load the page, go offline, and the generator still works — that is the simplest proof.
Why does my app say the QR code is invalid?
Two common causes. First, the key is not really Base32 — check it contains no 0, 1 or 8. Second, the original service uses non-default settings; a few use 8 digits or a 60-second period, and if you generate with the defaults the codes will be consistently wrong. Match the settings the service told you to use.
Can I create a QR for an HOTP account?
Not with this tool. HOTP is counter-based rather than time-based, so the QR must also carry the current counter value, and getting it wrong silently desynchronises the account. The difference is explained in TOTP vs HOTP.
Is it safe to keep the generated QR image?
Treat it exactly like the secret key itself, because that is what it is. A QR code sitting in your camera roll, in cloud photo backup, or printed and left on a desk is a working credential for anyone who sees it. Generate it, scan it, then delete the image.
Can I add the same key to two devices?
Yes, and it is often a good idea. TOTP is stateless: any number of devices holding the same secret produce the same codes. A second device you keep at home is a cheap insurance policy against losing your phone — see how to back up your authenticator app.
Related tools and guides
- QR Code to 2FA Secret Key — the reverse: read the key out of an existing QR image.
- 2FA Clock Checker — check whether your device time is causing code rejections.
- 2FA Live Code Generator — generate the six digits from a key.
- Best Google Authenticator alternatives
- Transferring Google Authenticator to a new phone