Build and validate private otpauth provisioning QR codes, confirm the live token before deployment, and export a recoverable setup pack without sending the seed anywhere.
Runs locally · secrets are not uploaded
Provisioning profile
Local QR
Default: 160-bit cryptographically random seed. It stays in memory only and is not stored by OneFreePlace.
Maximum-compatibility profile selected.
Provisioning URI
Authenticator QR
Generating…
Live code—
Refresh—
Seed—
URI bytes—
Provisioning integrity
Import existing otpauth URI
Paste a TOTP provisioning URI to audit label/issuer consistency and normalize its Base32 secret.
Round-trip audit
Issuer
—
Account
—
Algorithm
—
Digits / period
—
Canonical seed
—
Issuer label match
—
Offline recovery pack
The backup contains the MFA seed. Anyone who obtains it can generate your codes. Store it encrypted or offline; do not email it to yourself in plain text.
Manual-entry card
Service
—
Account
—
Secret
—
Profile
—
Compatibility rules
Safest interoperabilityUse SHA1, 6 digits and 30 seconds unless the target service explicitly provides other values.
Issuer appears twice on purposeFor broad app compatibility, include the issuer both as the label prefix and the issuer query parameter, and keep them identical.
Secret is the credentialThe QR encodes the shared TOTP seed. Do not publish or reuse it.
Deployment checklist
Generate or enter the seed.
Scan the QR in the authenticator app.
Confirm that the app's current code matches the live code shown here.
Store recovery material securely.
Only then enable/confirm MFA on the target service.