A 2FA QR code usually contains an account label, settings, and a Base32-encoded secret. The authenticator stores that secret.
Why the code changes
Standard TOTP divides Unix time into 30-second windows and combines the current window with the secret using HMAC.
Why Base32 is used
Base32 represents binary keys using uppercase letters and digits that are easier to print and scan.
Why the secret is sensitive
Anyone possessing it can generate valid codes until the service replaces it. Treat it as a durable credential.
Common failures
- Inaccurate device clock
- Incorrectly copied secret
- Different algorithm or timing settings
- A secret reset by the service
Generate a code locally
Web Crypto processes the secret without storing or submitting it.
Open TOTP Generator →