OTPAuth URI Generator for TOTP Authenticators

How to use the otpauth uri generator

1. Enter the Issuer name, which is typically your company or application name.
2. Type the Account identifier, such as an email address or username.
3. Paste the Base32 secret provided by your server or use a tool like the TOTP secret generator to create one.
4. Select the hash Algorithm, number of Digits and Period in seconds.
5. Copy the generated otpauth:// URI to configure your authenticator app or embed it in a QR code.

How the otpauth URI format works

The otpauth URI scheme follows a strict structure defined by the Key Uri Format specification. The general template is:

otpauth://totp/{issuer}:{account}?secret={secret}&issuer={issuer}&algorithm={algo}&digits={n}&period={s}

The path component combines the issuer and account separated by a colon. Both values must be percent-encoded if they contain spaces or special characters. For example, an issuer of "My App" becomes My%20App. The query string carries the parameters the authenticator needs to generate codes.

Consider a concrete example. With issuer "Acme", account "bob", secret "JBSWY3DPEHPK3PXP", SHA-1, 6 digits and a 30-second period, the otpauth URI generator produces:

otpauth://totp/Acme:bob?secret=JBSWY3DPEHPK3PXP&issuer=Acme&algorithm=SHA1&digits=6&period=30

The secret parameter is mandatory. The issuer parameter in the query string should match the issuer prefix in the path so older authenticator apps can display the correct label.

Validating the Base32 secret

TOTP secrets are encoded using Base32 as defined in RFC 4648. The alphabet consists of the uppercase letters A through Z and the digits 2 through 7. Characters outside this set, including 0, 1, 8 and 9, are invalid and will cause authenticator apps to reject the URI.

This otpauth URI generator strips spaces from the secret before validation, allowing you to paste grouped secrets like JBSW Y3DP EHPK 3PXP without manual editing. Lowercase letters are automatically converted to uppercase because Base32 decoding is case-insensitive in practice, though the canonical form uses uppercase.

A common mistake is confusing Base32 with Base64. Base64 includes lowercase letters, plus signs, slashes and equals padding. If your secret contains any of those characters, it is not valid Base32 and cannot be used directly in a TOTP URI.

Choosing algorithm, digits and period

Most authenticator apps default to SHA-1 with 6 digits and a 30-second period. This combination provides roughly one million possible codes per window, which is sufficient for most security requirements when combined with rate limiting on the server side.

If you choose SHA-256 or SHA-512, verify that your target authenticator app supports it. Older apps may silently fall back to SHA-1, producing incorrect codes without warning.

Using the URI with QR codes

The primary use case for an otpauth URI is encoding it into a QR code that a mobile authenticator scans. You can pass the output of this otpauth URI generator into a QR code generator to produce the scannable image.

When generating QR codes, keep the URI as short as practical. Long issuer names or account identifiers increase the QR code density, making it harder for phone cameras to read quickly. Percent-encoding adds characters, so concise labels improve scan reliability.

Some systems also accept the URI via clipboard or deep link instead of a QR code. The format remains identical regardless of the transport method.

Security considerations

The Base32 secret embedded in the URI is equivalent to a password. Anyone who obtains the URI can generate valid TOTP codes for that account. Never transmit otpauth URIs over unencrypted channels or log them in server access logs.

For production deployments, generate secrets using a cryptographically secure random number generator. A minimum of 16 bytes (128 bits) of entropy is recommended, which encodes to 26 Base32 characters. Secrets shorter than 10 bytes provide insufficient security against brute-force attacks.

After provisioning, store the secret securely on the server. If you need to verify the strength of your secrets, tools like the password entropy calculator can help estimate bit strength, though TOTP secrets are raw random bytes rather than human-chosen passwords.

Worked examples