QR Code สำหรับการยืนยันตัวตนสองขั้นตอน (2FA)
A TOTP enrolment code carries a single otpauth:// URI: the type, totp or hotp, an Issuer:Account label, a Base32 secret, and optional algorithm, digits and period parameters that default to SHA1, six digits and thirty seconds. Scanning it transfers the shared secret into the authenticator application. From that point the server and the application each compute HMAC(secret, floor(time/30)) independently and arrive at the same six digits, which rotate every thirty seconds. Google Authenticator, Microsoft Authenticator, Authy, 1Password and Bitwarden all read the format in full. The secret travels in plain text inside the symbol, so an enrolment code is a credential in its own right.
QR Codes for Two-Factor Authentication (2FA)
QR codes are the standard method for setting up Time-based One-Time Password (TOTP) authentication, enabling two-factor authentication across millions of services.
The otpauth:// URI Format
When a service enables 2FA, it generates a QR code encoding:
otpauth://totp/Example:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=Example&algorithm=SHA1&digits=6&period=30
| Parameter | Description | Default |
|---|---|---|
| Type | totp (time-based) or hotp (counter-based) |
N/A |
| Label | Issuer:Account format |
N/A |
secret |
Base32-encoded shared secret | Required |
issuer |
Service name | Recommended |
algorithm |
Hash algorithm (SHA1, SHA256, SHA512) | SHA1 |
digits |
Code length (6 or 8) | 6 |
period |
Code rotation interval in seconds | 30 |
How TOTP Works
- The service generates a random secret key
- The secret is shared via QR code (scanned into an authenticator app)
- Both the server and app independently compute: HMAC(secret, floor(time/30))
- The 6-digit code matches because both sides use the same secret and time
- Codes rotate every 30 seconds
Authenticator App Compatibility
| App | Platform | otpauth:// Support |
|---|---|---|
| Google Authenticator | iOS, Android | Full |
| Microsoft Authenticator | iOS, Android | Full |
| Authy | iOS, Android, Desktop | Full |
| 1Password | All platforms | Full |
| Bitwarden | All platforms | Full |
Security Best Practices
For services implementing 2FA: - Generate secrets with a cryptographically secure random number generator - Use at least 160-bit (20-byte) secrets - Display the QR code only once during setup — do not store or email it - Provide backup codes alongside the QR code setup - Support multiple authenticator apps (do not require a specific one)
For users: - Never screenshot 2FA QR codes — the secret is embedded in the image - Use an authenticator app, not SMS-based 2FA when possible - Store backup codes securely (password manager or printed in a safe) - Scan the QR code in a private setting (not in public where cameras might capture it)
Key Takeaways
- 2FA QR codes encode the shared TOTP secret in an otpauth:// URI
- The secret, issuer, algorithm, and period are all encoded in the QR code
- All major authenticator apps support the otpauth:// format
- Never screenshot or share 2FA QR codes — they contain the secret key
- Services should generate cryptographically strong 160-bit+ secrets
คำถามที่พบบ่อย
What does a 2FA QR code actually contain?
A single otpauth:// URI. It names the type (totp for time-based codes, hotp for counter-based ones), carries an Issuer:Account label, and holds the Base32-encoded shared secret. Optional parameters set the hash algorithm, the code length and the rotation interval, defaulting to SHA1, six digits and thirty seconds when they are omitted.
Why do the phone and the server show the same code with no network traffic?
Both sides compute the same function over the same inputs. The server and the authenticator each hold the secret transferred during enrolment, and each evaluates HMAC over that secret and the current thirty-second time window. An identical secret and an identical window yield identical digits, so no message passes between them at the moment of verification.
Which authenticator apps read the otpauth:// format?
Google Authenticator and Microsoft Authenticator on iOS and Android, Authy across mobile and desktop, and the built-in authenticators in 1Password and Bitwarden on every platform they support. All of them implement the format in full, including the issuer, algorithm, digits and period parameters.
What is the risk if an enrolment QR code is photographed or shared?
The secret sits in the symbol as plain text, so anyone who decodes the image holds everything required to generate valid codes indefinitely. An enrolment code is a credential rather than a convenience, and a screenshot of one in shared documentation or a support ticket carries the exposure of a leaked password.