Content
Generated directly in your browser. The 2FA secret is not uploaded or saved on QR Global.
Preview
QR code will appear here after generation
Design presets
One-click styles — all stay scannable
Color Presets
Module gradient
Background gradient
Why an OTP authenticator QR code
Two-factor authentication usually starts with a QR code on a setup screen, but that screen is gone the moment you close it, and all that remains is a long setup key in Base32. An OTP QR code rebuilds the setup code from that key, so any authenticator app can add the account by scanning instead of typing. Enter the account name, the service as issuer and the secret; choose time-based TOTP or counter-based HOTP and, if the service asks for it, a different algorithm, length or period. The image is created in your browser only: the secret is not sent to QR Global, not saved in your history and not wrapped in a tracking link.
- Adds a 2FA account to Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden or Authy by scanning.
- The secret never leaves your browser: no server copy, no history entry, no redirect.
- Supports TOTP and HOTP, SHA1, SHA256 and SHA512, six or eight digits and a custom period.
- Spaces, dashes and padding in a pasted key are cleaned up automatically.
Moving to a new authenticator app
You kept the setup key from a service but not its QR code, and the new app on your new phone needs a scan.
Paper backup in a safe
A printed code stored offline restores the account if the phone with the authenticator is lost.
Shared team accounts
An administrator enrols the same service login in each colleague's password manager without reading the key aloud.
Developers testing 2FA
Teams building TOTP into their own product create test codes with specific algorithms and periods.
Kiosks and shared devices
Support staff set up a sign-in on a device that has a camera but no convenient keyboard.
More Productivity QR codes
Same category — pick the type that fits your content.
Preview
QR code will appear here after generation
OTP Authenticator QR Code Generator
An OTP QR code isn't a one-time code itself — it's the secret used to set up a code generator in an authenticator app, after which codes are generated locally and rotate every 30 seconds.
What is this QR code?
Scanning it with Google Authenticator, Authy or another authenticator app imports an otpauth:// URI with the secret key, and the app starts producing TOTP codes for two-factor sign-in.
Best use cases
- ✓Setting up 2FA for a new service account by scanning instead of typing the secret key manually.
- ✓A backup QR code for recovering two-factor authentication after switching phones.
- ✓Corporate onboarding to configure VPN access via TOTP.
- ✓IT department documentation for quickly adding an employee to an authenticator app.
How to generate your QR code
Find the setup key the service shows when you turn on two-factor authentication.
Enter the account, the issuer and the Base32 secret; keep the default settings unless told otherwise.
Scan the image with your authenticator app and confirm with the first code it generates.
Keep the downloaded file offline, or delete it once the account has been added.
Frequently Asked Questions
Is the code inside the QR code the actual one-time password?
No, the QR code contains only the setup secret — the actual one-time code is generated locally on the device and changes periodically.
Which apps support this format?
The otpauth:// format follows the TOTP standard (RFC 6238), compatible with Google Authenticator, Authy, 1Password, and others.
Is the QR code itself a one-time password?
No. It contains the setup secret. After scanning, the authenticator app calculates a new code every 30 seconds, or on each press for HOTP, entirely on the phone.
Does QR Global store my secret?
No. For this type the image is drawn in your browser, nothing is sent to our server and the code does not appear in your history. Close the page and nothing remains except the file you downloaded.
Which settings should I choose?
Keep the defaults, SHA1, six digits and 30 seconds, unless the service states otherwise. Some authenticator apps ignore other values, which leads to codes that the service rejects.
What do account and issuer mean?
The issuer is the service name, such as your company or the website, and the account is usually your email or username. Together they form the label you see in the authenticator app; a colon is not allowed in either.
When do I need HOTP and a counter?
Only when the service explicitly uses counter-based codes, which is rare. Most websites and VPNs use time-based TOTP; HOTP also requires the current counter value.
How should I keep the image?
Like a master key: whoever has it can generate your codes indefinitely. Print it or keep it on an encrypted drive, and delete the downloaded file from shared folders and chat histories after scanning.