Decode otpauth-migration exports
Paste a Google Authenticator migration payload and recover one standard otpauth:// URI per account.
About this tool
Google Authenticator's export QR uses an otpauth-migration://offline?data=...
link that bundles multiple accounts in a compact protobuf payload. This tool
decodes that payload locally and rebuilds standard single-account otpauth://
provisioning URIs that other password managers and authenticator apps can
import.
Paste either the full migration link or only its data value. The default output
is one otpauth:// URI per line; switch to JSON when you need issuer, account
name, base32 secret, algorithm, digits, counter, and rebuilt URI as structured
fields.
Worked example:
otpauth://totp/Example:alice%40example.com?secret=JBSWY3DP&issuer=Example&algorithm=SHA1&digits=6&period=30
otpauth://hotp/ACME:bob?secret=K5XXE3DE&issuer=ACME&algorithm=SHA256&digits=8&counter=5
Limits and edge cases: this is a text decoder, not a QR-image scanner. Use your
camera or a QR decoder first if you only have a screenshot. The migration payload
does not carry custom TOTP periods, so TOTP entries are emitted with the standard
period=30. Unsupported protobuf enum values and truncated payloads return an
explicit error instead of guessing.
FAQ
Can I paste the whole otpauth-migration link?
Yes. Paste the full otpauth-migration://offline?data=... value, or paste only
the data payload. The decoder accepts standard base64, base64url, missing
padding, and percent-escaped payloads.
Does this reveal my 2FA secrets to a server?
The block is pure Rust and the page runs it in browser WebAssembly. The decoded secrets appear in the output because that is the purpose of the export, so treat the result like credentials and do not paste it into logs or tickets.
Why do TOTP entries always include period=30?
The Google Authenticator migration protobuf stores the secret, issuer, account,
algorithm, digits, type, and HOTP counter, but it does not store a custom TOTP
period. Authenticator apps use 30 seconds by default, so the rebuilt TOTP URIs
state period=30 explicitly.
Can it scan a QR image directly?
No. This tool decodes the text payload after a QR has already been read. If you
only have a PNG or screenshot, run it through a QR decoder first and paste the
resulting otpauth-migration:// text here.
Developer & Automation Access
Run it from the terminal
Same engine as this page, headless — via the gizza CLI:
gizza tool otpauth-migration-decoder "otpauth-migration://offline?data=CikKBUhlbGxv... or just CikKBUhlbGxv..."New to the CLI? Get gizza →
Open it by URL
Pre-fill and auto-run this tool with query parameters — the names match the API/CLI:
https://gizza.ai/tools/otpauth-migration-decoder/?payload=otpauth-migration%3A%2F%2Foffline%3Fdata%3DCikKBUhlbGxv...%20or%20just%20CikKBUhlbGxv...&format=uriMachine-readable descriptor: tool.json — title + parameters JSON Schema for agents.