Free TOTP / 2FA QR Code Generator

Build a static otpauth:// enrollment QR for Google Authenticator and compatible apps—Base32 secret encoded locally, no signup, no short link that dies after a trial. This page is not an authenticator app.

✓ No signup ✓ Never expires ✓ Client-side only ✓ PNG & SVG

Lawful use only. For your own service or authorized test enrollment—not unauthorized account takeover. Not Google / Microsoft / Apple / Authy official. The QR and PNG equal the secret: do not email, chat, or cloud-album them. Secrets are not stored or recoverable here.

Generate your TOTP / otpauth QR

Enter issuer, account label, and Base32 secret. We assemble a Google Key URI Format payload in your browser. Spaces in the secret are stripped and letters uppercased. Invalid or empty fields show a clear error—no silent QR. Defaults: SHA1 / 6 digits / 30s.

1. Account & secret

TOTP (time-based) is what Google Authenticator and most apps expect. Defaults: SHA1, 6 digits, 30-second period.

Shown in the authenticator app. When set, the label becomes Issuer:account and issuer= is added to the URI.

Usually an email or username for this enrollment.

A–Z and 2–7 only after cleanup. Aim for ~16+ characters (80+ bits). Do not paste secrets into chat or email.

Advanced (algorithm / digits / period)

Changing these from defaults may break Google Authenticator compatibility. A warning appears when you leave SHA1 / 6 / 30.

Default 30. Only included in the URI when not 30.

2. Style

Payload (otpauth://)

Privacy: the secret stays on your device. Nothing is uploaded. We do not write the secret to localStorage—refresh clears the form. Treat PNG/SVG downloads like passwords.

3. Preview & download

Your TOTP enrollment QR will appear here. It encodes otpauth:// directly—no redirect server.

How otpauth / TOTP QR codes work

Authenticator apps (Google Authenticator, Microsoft Authenticator, Authy, and others) scan an otpauth://totp/… URI that follows the Google Key URI Format (RFC 6238 for TOTP). The URI carries a Base32 secret plus optional issuer, algorithm, digits, and period.

URI policy on this page: we omit algorithm, digits, and period from the URI when they equal the defaults (SHA1 / 6 / 30) to keep the payload short. Non-defaults are included explicitly. HOTP uses otpauth://hotp/… and always includes counter=.

Example (issuer Example, account user@example.com, secret JBSWY3DPEHPK3PXP):

otpauth://totp/Example:user%40example.com?secret=JBSWY3DPEHPK3PXP&issuer=Example

This tool creates an enrollment QR only. It does not generate one-time codes, store secrets, or recover lost authenticators. For export/migrate between apps, use each vendor’s official export flow.

FAQ

What is a TOTP / otpauth QR code?

A QR that encodes an otpauth:// enrollment URI so an authenticator app can add a TOTP (or HOTP) account.

Is this Google Authenticator, Microsoft Authenticator, Authy, or Apple?

No. QRStatic is not affiliated with those vendors. This page is not an authenticator app and cannot store or recover secrets.

Will Google Authenticator honor SHA256, 8 digits, or a custom period?

Often no. Google Authenticator and some apps may ignore non-default algorithm, digits, or period. Prefer SHA1 / 6 / 30 unless you control the verifier. Changing advanced options shows a visible warning.

Is my secret uploaded or saved?

No. Everything runs in your browser. Secrets are not uploaded and are not written to localStorage—refresh clears the form.

Is the QR or PNG the same as the secret?

Yes. Anyone who scans the QR or opens the PNG/SVG can enroll the same secret. Do not send images by email, chat, or cloud album. Delete unused copies.

Can I use this for any account?

Only for lawful own-service or authorized test enrollment. Do not use this to assist unauthorized account takeover.

Does this TOTP QR expire?

A static otpauth payload does not expire because of a generator trial—the data lives in the image. Your server and authenticator apps still control verification.

How do I migrate or export an existing authenticator?

Use the official export/migrate flow in Google Authenticator, Authy, or your IdP. This page does not reverse-engineer vendor export blobs.

Next steps: WiFi QR · vCard QR · Phone call / tel QR · Email / mailto QR · SMS QR · WhatsApp click-to-chat QR · Location / Maps QR · Calendar event QR · Google review QR · Homepage generator · Spotify playlist QR