The QR Code in Your Authenticator App: What's Actually in It

What it is (one-paragraph answer)

That QR code your bank, email provider, or work login shows during two-factor setup isn't a picture of anything. It's an otpauth:// link containing a shared secret key. Scan it once with your authenticator app, and it saves that secret, generating a new 6-digit code every 30 seconds from then on. Compare that to how QR code login works, where the code is a short-lived session handshake that expires in seconds. A 2FA setup code works the opposite way: once scanned, the secret inside it is good forever, on any device that holds a copy.

How it actually works

The otpauth:// link, piece by piece

Every 2FA setup QR code decodes to a URI that looks roughly like this:

otpauth://totp/YourBank:you@email.com?secret=JBSWY3DPEHPK3PXP&issuer=YourBank&digits=6&period=30

Only one field is required: secret, a Base32-encoded key that both your phone and the service's server already agree on. Everything else — issuer, account label, algorithm, digit count, time step — just tells your app how to format the code and what to call the entry. Nearly every consumer authenticator app uses TOTP, time-based, with the code changing every 30 seconds by default. The less common alternative, HOTP, advances a counter instead of a clock.

Encoded isn't the same as encrypted

Base32 is a text encoding, not a cipher. It's reversible by design — the same property that lets your phone's camera decode the QR code instantly also means anyone else who reads that code decodes the identical secret. The technical spec for TOTP puts it plainly: an attacker with access to the shared secret can generate valid codes at will. No password sits behind it. The secret itself is the entire security boundary.

Where you'll see it

Two-factor setup codes show up anywhere 2FA is turned on: banking apps, email providers, work SSO portals, password managers like 1Password or Bitwarden. Most setup screens also offer a "can't scan? enter this code manually" fallback — that's the exact same Base32 secret, just typed instead of encoded into a QR pattern.

Why a screenshot is a permanent copy

It's tempting to screenshot the setup QR code "just in case." Don't. A screenshot is a plaintext copy of your second factor, and once it exists it behaves like any other photo — syncing to cloud backup, getting swept into a screen recording, or ending up attached to a support ticket by accident. The same trick that lets you conveniently import a code by scanning a QR code from a screenshot is exactly what makes a leaked screenshot dangerous: anyone who opens that image can scan it too, and unlike a reused password, there's no "new device signed in" alert to warn you.

It gets worse, because most setup codes aren't minimal. The spec recommends including an issuer name and account label alongside the secret, for usability's sake. So a leaked QR code often tells an attacker exactly which service and account it unlocks — not just a bare, anonymous key. One guide to generating your own TOTP codes argues the opposite: "data economy" — put only the secret in the code, label the entry by hand afterward.

Tips, gotchas, and a quick how-to with QRDock

• Scan it once, close the setup screen, and don't screenshot it "for later."
• Need a backup? Use your authenticator app's own encrypted export or sync feature (Authy, 1Password, and others support this) instead of a photo.
• Keep any one-time backup codes the service gives you stored separately from the QR code — they're a different recovery mechanism entirely.
• Not sure whether a code you're about to scan is a real setup screen? Is it safe to scan a QR code covers the general picture.

QRDock's scanner flags suspicious QR content before you tap through, which comes in handy for any code you're unsure about — including one shown to you unexpectedly by a site or email claiming to be a 2FA prompt.

Frequently Asked Questions

Is the QR code in my authenticator app the same as my password?

Not exactly, but it deserves the same care. It's an enrollment code containing the shared secret your app uses to generate 6-digit codes, and anyone who captures it can generate valid codes too.

Can I screenshot my 2FA QR code to back it up?

You can, but that screenshot is a permanent, plaintext copy of your second factor. If it ends up in cloud backup or gets shared by mistake, your 2FA is compromised. Use your authenticator app's own encrypted export or sync feature instead.

What's actually encoded in an authenticator app QR code?

An otpauth:// link with a Base32-encoded secret key, plus optional fields for account label, issuer name, algorithm (usually SHA1), digit count (usually 6), and time step (usually 30 seconds).

Is the secret in the QR code encrypted?

No — it's Base32-encoded, a reversible text format, not encryption. Anyone who reads the QR code, whether by scanning it or decoding a saved image, can read the secret in plain text.

Conclusion

A 2FA QR code is a shared secret in disguise, not a picture. It's encoded so your phone's camera can read it instantly, but not encrypted, so anyone else who reads it can too. Treat it the way you'd treat a password: scan it once, back it up through your authenticator app's own encrypted export if you need a copy, and never leave a screenshot of it lying around.