otpauth:// URI parser

About this tool

A two-factor setup QR code is just a picture of a text link. Decode the QR and you get an otpauth:// provisioning URI — the Key Uri Format that Google Authenticator, Authy, 1Password, Microsoft Authenticator and effectively every other authenticator app reads. This tool takes that link apart and shows you every field it carries: the OTP type, the issuer, the account name, the base32 shared secret, the HMAC algorithm, the code length, and the time step (TOTP) or starting counter (HOTP).

It is a reader, not a code generator: it never contacts a server, and the secret you paste stays in your browser.

What you get back

• type — totp (time-based) or hotp (counter-based).
• issuer — the provider name in effect. The URI can carry it twice, as a label prefix (ACME Co:[email protected]) and as an issuer= parameter; the parameter wins, and a disagreement between the two is reported.
• account — everything after the first colon in the label, percent-decoded and with the spec's optional space after the colon trimmed.
• secret — normalized to unpadded upper-case base32 and validated against the RFC 4648 alphabet, plus its length in characters and in decoded bytes.
• algorithm / digits / period / counter — with the Key Uri Format defaults (SHA1, 6 digits, 30-second period) filled in when the URI omits them and listed under defaults_applied so you can see what was assumed rather than stated.
• extra_parameters — anything outside the spec (e.g. an image= icon URL) kept verbatim.
• warnings — non-fatal compatibility problems most apps will silently paper over.

Worked example

Input:

otpauth://totp/ACME%20Co:[email protected]?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=ACME%20Co&algorithm=SHA1&digits=6&period=30

Output with Readable lines selected:

type:        totp
issuer:      ACME Co
account:     [email protected]
label:       ACME Co:[email protected]
secret:      HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ
secret size: 32 chars, 20 bytes
algorithm:   SHA1
digits:      6
period:      30 seconds

Pick JSON instead for a machine-readable object (including defaults_applied and warnings), or ASCII table for something you can paste into a terminal or a wiki.

Output formats and options

• JSON — every field as an object, with null for the field that does not apply (counter on TOTP, period on HOTP).
• Readable lines — aligned key: value lines, with a Warnings (n): block appended when there is anything to flag.
• ASCII table — the same rows in a bordered Field | Value table.
• Mask the secret — replaces the secret with asterisks while keeping secret_chars and secret_bytes accurate, so you can share the parse in a bug report without leaking the credential.
• Strict mode — turns the spec's recommendations into hard errors: a missing issuer, an issuer that differs between the label and the issuer= parameter, a digit count other than 6 or 8, a duplicate parameter, or any parameter outside the Key Uri Format. Useful when you are validating URIs you generate rather than diagnosing one you received.

Limits and edge cases

• One URI per run. A otpauth-migration://offline?data=… export (Google Authenticator's "transfer accounts" payload) bundles several accounts in a protobuf blob — this tool detects it and tells you to expand the export first.
• The input is capped at 4096 characters; real provisioning URIs are well under 300.
• Line breaks and tabs are stripped before parsing, so a URI wrapped across lines by an email client still works (you get a warning saying so).
• A label with more than one colon is split on the first one, matching how apps read it, and warns you that it was ambiguous.
• Percent-decoding is lenient: a stray % that is not followed by two hex digits is kept literally instead of failing the whole parse.
• Duplicate query parameters keep the first value, as most parsers do.
• secret is required. Digits outside 1–10, a zero period, an HOTP URI with no counter, an unknown OTP type, and a non-base32 secret are all hard errors, in every mode.

FAQ