security_totp_qr_generator
Build, parse, or generate secrets for otpauth TOTP/HOTP URIs to enrol in two-factor authentication with authenticator apps.
Instructions
2FA TOTP/HOTP otpauth URI Builder and Parser. Build, parse, or seed otpauth:// Key-URI strings for two-factor authentication (RFC 6238 TOTP, RFC 4226 HOTP), compatible with Google Authenticator, Authy, 1Password, Microsoft Authenticator, and Bitwarden. The single operation field selects one of three actions. buildUri assembles an otpauth:// URI from a supplied base32 secret plus issuer/account/algorithm/digits/period (it does NOT invent a secret) and returns app-compatibility warnings. generateSecret returns a fresh random base32 secret (non-deterministic, CSPRNG via random_bytes) of the requested byte length. parseUri decodes an existing otpauth:// URI back into its fields. The QR image itself is rendered client-side in the browser from the returned URI; the server only produces the string and never contacts an external service. Use osint_qr_code_generator for general-purpose QR codes (WiFi, vCard, plain URLs); use this tool only for authenticator-app 2FA enrolment URIs. Read-only, non-destructive, rate-limi
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| operation | Yes | Action to perform: buildUri (assemble an otpauth URI from supplied fields), generateSecret (return a fresh random base32 secret), or parseUri (decode an existing otpauth URI). | |
| type | No | buildUri only. otpauth scheme: time-based (totp) or counter-based (hotp). Determines whether period or counter applies. | totp |
| issuer | No | buildUri only. Organisation/service name shown in the authenticator app (e.g. GitHub). Optional but recommended; omitting it triggers a warning. | |
| account | No | buildUri only. Account label shown in the app (e.g. alice@example.com). Required for buildUri. | |
| secret | No | buildUri only. Base32-encoded shared secret (RFC 4648 alphabet A-Z 2-7); whitespace stripped and upper-cased. Required for buildUri. Non-base32 input still builds but is flagged in warnings. | |
| algorithm | No | buildUri only. HMAC hash. Most apps (notably Google Authenticator) assume SHA1; non-default values trigger a compatibility warning. | SHA1 |
| digits | No | buildUri only. Number of code digits. Most apps assume 6. | |
| period | No | buildUri with type totp only. Time step in seconds (RFC 6238). Ignored for hotp. | |
| counter | No | buildUri with type hotp only. Initial HOTP counter (RFC 4226). Ignored for totp. | |
| byteCount | No | generateSecret only. Raw random bytes before base32 encoding. RFC 6238 recommends 20 (160 bits) for SHA1. | |
| uri | No | parseUri only. An existing otpauth:// URI to decode into component fields. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| success | No | Whether the operation succeeded. | |
| operation | No | The operation that was executed (buildUri, generateSecret, or parseUri). | |
| result | No | Operation payload. buildUri returns uri/type/issuer/account/secret/algorithm/digits/period/counter/warnings. parseUri returns the same fields minus uri and warnings. generateSecret returns secret/byteCount/bits. | |
| error | No | Present only on failure: human-readable validation/runtime message. |