{
  "slug": "otpauth-uri-parser",
  "name": "gizza-ai/otpauth-uri-parser",
  "version": "0.1.0",
  "title": "otpauth:// URI Parser — decode a 2FA setup link — gizza.ai",
  "description": "Paste an otpauth:// provisioning URI and see its type, issuer, account, base32 secret, algorithm, digits, and period or counter. Runs in your browser.",
  "tags": [
    "otpauth",
    "totp",
    "hotp",
    "2fa",
    "authenticator",
    "two-factor",
    "provisioning uri",
    "key uri format",
    "base32 secret",
    "otp"
  ],
  "category": "security",
  "urls": {
    "page": "https://gizza.ai/tools/otpauth-uri-parser/",
    "markdown": "https://gizza.ai/tools/otpauth-uri-parser/index.md",
    "descriptor": "https://gizza.ai/tools/otpauth-uri-parser/tool.json",
    "deep_link_example": "https://gizza.ai/tools/otpauth-uri-parser/?uri=otpauth%3A%2F%2Ftotp%2FACME%2520Co%3Ajohn.doe%40email.com%3Fsecret%3DHXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ%26issuer%3DACME%2520Co%26algorithm%3DSHA1%26digits%3D6%26period%3D30&format=json&mask_secret=true&strict=true"
  },
  "cli": "gizza tool otpauth-uri-parser \"otpauth://totp/ACME%20Co:john.doe@email.com?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=ACME%20Co&algorithm=SHA1&digits=6&period=30\"",
  "tool": {
    "description": "Parse a single otpauth:// provisioning URI (the Key Uri Format authenticator apps read from a 2FA QR code) into its fields: type (totp or hotp), issuer, account name, base32 secret, algorithm, digits, and period or counter. The label is percent-decoded and split on its first colon, the secret is normalized to unpadded upper-case base32 and validated against RFC 4648, and the spec defaults (SHA1, 6 digits, 30-second period) are applied and reported under defaults_applied. Warnings flag an issuer that differs between the label and the issuer parameter, a missing issuer, non-standard digit counts, duplicate or unknown query parameters, and a counter on a totp URI. Set format=json (default), text, or table; mask_secret=true hides the secret while keeping its length; strict=true turns those warnings into errors. Runs locally — the secret never leaves the device.",
    "parameters": {
      "additionalProperties": false,
      "properties": {
        "format": {
          "default": "json",
          "description": "Output format: json (default) returns every field plus warnings as an object; text returns aligned key: value lines; table returns an ASCII field/value table.",
          "enum": [
            "json",
            "text",
            "table"
          ],
          "type": "string"
        },
        "mask_secret": {
          "default": false,
          "description": "Set true to replace the secret with asterisks so the result is safe to paste into a ticket or screenshot. The reported secret_chars and secret_bytes stay accurate. Default false.",
          "type": "boolean"
        },
        "strict": {
          "default": false,
          "description": "Set true to enforce the Key Uri Format's recommendations as errors instead of warnings: a missing issuer, an issuer mismatch between label and query, a digit count other than 6 or 8, a duplicate parameter, or any parameter outside the spec will fail. Default false (report them as warnings).",
          "type": "boolean"
        },
        "uri": {
          "description": "The otpauth:// provisioning URI to parse, e.g. otpauth://totp/ACME%20Co:john.doe@email.com?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=ACME%20Co&digits=6&period=30. Line breaks in a pasted URI are ignored; the limit is 4096 characters.",
          "type": "string"
        }
      },
      "required": [
        "uri"
      ],
      "type": "object"
    }
  }
}