Short answer: A 2FA QR code is not a picture — it is a short line of text called an otpauth URI, containing your account name and, crucially, the secret key in plain form. Anyone who scans or photographs that code can generate valid codes for your account forever, silently, with no way for you to detect it. That is why the advice against screenshotting it appears in every guide we write.
The text hiding in the squares
Decode a 2FA setup QR code and you get something like this:
otpauth://totp/GitHub:yourname?secret=JBSWY3DPEHPK3PXP&issuer=GitHub&algorithm=SHA1&digits=6&period=30
That is the whole thing. Broken down:
- otpauth://totp/ — this is a time-based one-time password credential (as opposed to
hotp, the counter-based variant covered in TOTP vs HOTP). - GitHub:yourname — the label your app displays. Cosmetic.
- secret=JBSWY3DPEHPK3PXP — this is the entire security of your second factor, encoded in Base32.
- issuer=GitHub — the service name, used for grouping and icons.
- algorithm=SHA1, digits=6, period=30 — the parameters. Almost always these defaults.
The QR code is simply a convenient way to type that string into your phone. It contains no encryption, no protection, and no expiry. It is a plain-text secret in a machine-readable wrapper.
Why the secret is so dangerous
The secret is the seed from which every future code is calculated. Combined with the current time, it produces the six digits — which is why your app works offline, and why any app produces the same codes from the same secret. The mechanism is explained in what is a TOTP code.
The consequences of that design:
- It never expires. Unlike a password, there is no rotation policy and no forced reset.
- It is silent. An attacker with your secret generates codes on their own device. Nothing appears in your account activity, no notification fires, nothing changes.
- It is unlimited. Any number of devices can hold the same secret and produce identical codes simultaneously.
- Only re-enrolment revokes it. Changing your password does nothing. You must disable and re-enable 2FA to generate a new secret.
That last point is worth remembering when someone leaves a team who once scanned a shared account’s code — see 2FA for small teams.
Where these codes leak
Not usually through anything sophisticated:
- Screenshots. Taken “just in case”, then synced to a cloud photo library, backed up, and occasionally shared to the wrong album.
- Screen sharing and streaming. Setting up 2FA during a call, a recorded demo, or a live stream. It happens to developers and creators regularly.
- Support tickets and chat. Pasting a setup page screenshot to show a problem.
- Printed onboarding documents for shared accounts, left in a shared drive.
- Photographs of a colleague’s monitor.
- Untrustworthy online TOTP tools that process the secret server-side rather than in your browser — we cover how to judge these in is an online 2FA code generator safe?
What you should do with it instead
Scan it into two devices while it is on screen. This is the legitimate use of the secret’s copyability, and it is the single best backup available: two phones, or a phone and a tablet, both generating identical codes forever, with no cloud sync or export file involved.
You cannot do this later. Once the setup page closes, the secret is gone from your side. See how to back up your authenticator app.
If you must store the secret — for a shared business account, say — put it in an encrypted password manager vault, never a plain note or an image. And treat access to that vault as equivalent to holding the second factor, because it is.
Use the text key rather than the image when you need manual entry — it is easier to handle carefully than a picture. See entering a setup key manually.
If you think a code has leaked
Do not wait for evidence — there will not be any.
- Disable 2FA on the affected account and re-enable it. This generates a fresh secret and invalidates the old one. Nothing else does.
- Regenerate backup codes, since the old set may have been exposed alongside it.
- Change the password too, as the two are often exposed together.
- Check active sessions and sign out anything unfamiliar.
- Delete the screenshot everywhere — device, cloud library, recently deleted folder, and any backups.
A note on QR codes generally
Since we are on the subject: QR codes are just text, and you cannot read them before scanning. That makes them a useful phishing vehicle — codes on parking meters, in emails, and on posters that lead to fake login pages. The technique even has a name, quishing.
Two habits: use a scanner that shows you the URL before opening it, and never log in on a page you reached by scanning a code from a physical surface or an unexpected email. The reasoning is the same as in can 2FA be hacked? — the attack is on your trust, not on the cryptography.
Frequently asked questions
Is the secret in the QR code encrypted?
No. It is Base32-encoded, which is an encoding for readability, not encryption. Anyone can decode it instantly.
Can I reuse the same QR code on a new phone later?
Only if you kept the secret, which you generally should not. The right approach is a proper backup, or re-enrolling the account.
Why do apps show a text key next to the QR code?
For manual entry when scanning is impossible — most often when the code is displayed on the same phone you are adding it to.
Does the label in the QR code affect security?
No. The label and issuer are cosmetic, controlling only how the entry appears in your app. Only the secret matters.
Can two people share one authenticator entry?
Technically yes — that is how shared business accounts work. Do it through an encrypted shared vault rather than by passing images around, and re-enrol when someone leaves.
How do I know if my secret has been stolen?
You almost certainly cannot, which is the core problem. Treat any exposure as confirmed and re-enrol.
The bottom line
That grid of squares is a plaintext password that never expires and never announces itself. Scan it into two devices while it is on screen, then let it disappear — and if it ever ends up in a screenshot, a stream or a chat window, re-enrol the account rather than hoping nobody noticed.
Want to see the mechanism for yourself? Our browser-based 2FA code generator computes codes locally, without transmitting your key.