otpauth specification

This demo of the otpauth specification will add a new verification code generator to your password manager using a link or button — providing for a better experience than scanning QR code or manually adding secret key text.

Optional: Save Username & Password

This demo works best with saved credentials. Simulate an account registration below to save credentials in your passwords manager. This website () does not save these credentials or validate them at sign-in.

does not save or validate these credentials

Already Registered?
Sign In

Setup Verification Code

Add a new verification code generator to your password manager using the button below or this link: Add to Password Manager

You password manager will suggest adding the verification code generator to any saved credentials that match the issuer domain (example: ) listed in the otpauth URI.

other options: copy Secret Key or scan QR Code below.

Confirm that your password manager has saved the secret key and can generate new one time codes every 30 seconds.

Other Setup Options

While developers often reference an “authenticator app” and show a QR code during setup, using a mobile device is entirely optional when setting up a verification code generator.

Show these fallback options to support platforms, browsers, or password managers that do not support otpauth links.

Settings

Change the settings above and generate a new URI and QR code based on the otpauth specification.

Specification Details

The otpauth URI scheme has provisional status with IANA, but there is there is no consistently applied industry standard for otpauth URLs (let alone an accepted internet standard).

Apple and Google are aligned on an otpauth specification, but they have different recommendations on the use of issuer label prefix and issuer parameter. This demo follows Apple’s recommendation to ensure password manager can use the issuer parameter to suggest credentials when adding a new verification code generator.

Google

  • “If both issuer parameter and issuer label prefix are present, they should be equal.” November 2018

Apple

  • The issuer parameter is “the domain of the site or app” while the issuer label prefix is “the proper name of your service.” WWDC 2021
  • “Use a button or link to open an otpauth: URL” WWDC 2024