TOTP (Time-based One-Time Password) is a standard algorithm (RFC 6238) that generates a short code - typically 6 digits - that changes every 30 seconds. It is widely used as a second factor in two-factor authentication (2FA): even if someone knows your password, they also need the current code from your authenticator app.

Both you and the service share the same secret key. Your device computes HMAC-SHA1(secret, floor(time / 30)) and truncates the result to 6 digits. The server does the same calculation independently. Because both sides use the same secret and the same current time slot, the codes match - without ever transmitting the code over the network.

The most common cause is a clock that is out of sync. TOTP codes are tied to the current time, so even a drift of a minute can cause failures. Most services tolerate a ±1 window (up to 30 seconds off), but beyond that the codes will consistently not match. Check your device's date and time settings and make sure automatic time sync is enabled.

They are two representations of the same thing. The QR code encodes an otpauth:// URI - a standardised format that bundles the secret together with metadata like the account name, issuer, algorithm, and digit count. Scanning the QR code in an authenticator app is just a convenient way to transfer that URI without typing. The raw secret (the Base32 string) is the actual key used to generate codes; everything else is optional context.

They are optional labels that help you identify the entry in an authenticator app.
• The issuer is the name of the service or organisation (e.g. GitHub, Facebook, Google, Acme Corp, ...).
• The account name is usually your username or email address for that service (e.g. alice@example.com).
Neither field affects the generated codes - they are purely cosmetic metadata embedded in the QR code so your authenticator app can display a meaningful label instead of a raw secret.

Yes - if you lose access to your authenticator (lost phone, factory reset, uninstalled app) and have no backup of the secret, you will be locked out of any account that uses it. Store the secret or the QR code in a safe place, such as an encrypted password manager. Many services also offer recovery codes for exactly this scenario. You can also save the otpauth:// URI shown below the QR code directly in the Vault.

The URI is always the safer choice. The raw secret alone is technically sufficient for the majority of accounts - most services use the defaults (SHA-1, 6 digits, 30-second period), so a new authenticator app would produce the correct codes even without any extra parameters. However, if a service uses non-default settings (SHA-256, 8 digits, 60-second period, etc.) and you only saved the secret, your codes would silently be wrong with no obvious indication why. The otpauth:// URI bundles the secret together with all parameters into one self-contained string, making re-import reliable regardless of the configuration.

Most authenticator apps offer an export function that produces one or more QR codes. Scanning those codes with a camera or QR scanner reveals an otpauth-migration:// URL containing your account data encoded as a protobuf message. You can paste that URL into the ⊞ OTP Migration Decoder to extract the individual secrets and account names in a readable form.