Google Authenticator QR Decoder
A decoder that extracts the otpauth:// URI from a Google Authenticator, Authy or any other authenticator QR screenshot. The image is decoded directly in your browser tab via JavaScript — no /decode endpoint exists for this tool. Useful when switching from Google Authenticator to Aegis (Google's app has no plain export), backing up a fresh 2FA enrollment into a password manager, or restoring TOTP entries to a new phone.
How to use
Some authenticators let you re-display the QR (e.g. Authy "Show QR"). Or take a screenshot of the QR shown when you first enroll a new service.
Drop the screenshot or click to browse. The decoder will find the QR inside the image and extract the otpauth:// URI.
Compare the 6-digit code shown to the one in your old authenticator. They should match.
Scan the re-rendered QR into your new app, or copy the secret into a password manager for backup.
Recover the secret behind a 2FA QR code so you can migrate accounts between authenticator apps
Decoded entry
Features
FAQ
Where do my QR image and 2FA secret go?
The image is decoded by JavaScript on the page; the decoded secret is shown right on the page. We collect anonymous performance telemetry (decode timing, format detected, success/failure) like every Tembrica tool — see our Privacy Policy. For long-term secrets you can load the page once with the network on, then disconnect and re-do the decode offline.
Why would I want the secret?
To migrate between authenticator apps (Google Authenticator → Aegis is the most common, since Google's app has no plain export). To back the secret up in a password manager. To add the same account to a second device for redundancy.
Does it support HOTP?
Yes. HOTP URIs include a counter parameter, which is shown after decoding. Note that HOTP counters drift if both devices use the same secret independently.
Does it work with Google Authenticator's multi-account export QR?
Yes. Paste the special `otpauth-migration://` URI (or upload its QR screenshot) — every account inside is decoded with its secret, algorithm, digits, period and a one-click copy. This is the common path for moving off Google Authenticator into Aegis or Bitwarden.
Can I decode a secret on a machine that is off the network?
Yes — after the first visit the page is cached by the service worker, so you can disconnect the machine entirely and the decoder still works. That is worth doing for a secret that guards something valuable: an account's TOTP seed is the whole second factor, and decoding it on an air-gapped machine removes a class of risk that no promise about a website can remove for you. Two practical points. Cache the page before you disconnect, not after. And remember the decoded secret is now on that machine's clipboard and possibly in its screenshot folder — the air gap protects the transfer, not what you leave behind.
What apps can scan the re-rendered QR?
Any RFC 6238-compliant authenticator: Google Authenticator, Authy, Aegis, Microsoft Authenticator, 1Password, Bitwarden, FreeOTP, ente Auth.
We can! Just send us a quick message with your idea. If you'd like to discuss it in detail, leave your email and we'll get back to you. You can stay anonymous.
