A 2FA secret key is the private setup value that connects a website account to a TOTP authenticator. A service usually shows it while you enable two-factor authentication, either inside a QR code or as a manual setup key.
This guide helps you locate the correct value without confusing it with a password, SMS code, or recovery code.
Where can I find my 2FA secret key?
Sign in to the official website or app for the account and look in an area named Security, Login & security, Two-factor authentication, Two-step verification, or Authenticator app.
Start the authenticator-app setup. The service will usually display a QR code. Look for a nearby option such as:
- Can’t scan the QR code?
- Enter setup key manually
- Show secret key
- Manual entry
- Copy setup key
That option reveals the text secret encoded in the QR code. Only perform these steps for an account you own or are authorized to manage.
What does a 2FA secret key look like?
Most TOTP setup keys use Base32: uppercase letters A–Z and digits 2–7. Spaces may be added for readability. A simplified example looks like JBSW Y3DP EHPK 3PXP.
The length varies by service. A key should not be assumed valid merely because it looks like Base32. The issuing service determines the secret and any non-default settings.
QR code versus manual setup key
An authenticator QR code commonly contains an otpauth:// configuration URI. It can include the same secret plus an account label, issuer, algorithm, number of digits, and refresh period. The manual setup key is only the secret portion.
If a tool accepts only a Base32 secret, use the value labeled setup key or secret—not an image filename, account password, or the entire QR URL. The Get2FA.dev generator currently targets standard TOTP secrets.
Step-by-step: copy a manual setup key safely
- Confirm that you are on the official domain or official app.
- Open the account security settings and begin authenticator setup.
- Reveal the manual setup key beside the QR code.
- Copy it without quotation marks or labels.
- Add it to your trusted authenticator and verify the first code.
- Save the recovery codes offered by the service.
- Finish setup only after a test code is accepted.
Do not paste the secret into email, chat, a support ticket, or a public screenshot. Our About page explains the intended, privacy-focused use of this browser utility.
What if 2FA is already enabled?
Many services show the secret only once during initial setup. If you did not save it, you may not be able to reveal the original value later. An authenticator application might allow an export or protected backup, but this depends on the app and your organization’s policy.
The safe recovery path is normally to use a valid recovery method, disable the old authenticator enrollment, and set it up again. This creates a new secret and often a new set of backup codes. Revoking the old setup matters if you believe its key was exposed.
A 2FA secret is not a recovery code
These values serve different purposes:
- Secret or setup key: used repeatedly by an authenticator to calculate changing codes.
- TOTP code: a short code derived from the secret and current time.
- Recovery code: an emergency, often single-use code supplied by the account provider.
- Password: the primary credential for the account.
Never enter your password into a TOTP generator. If you only have a recovery code, use the account provider’s recovery-code flow.
How to protect the secret key
- Store it only in a trusted authenticator or encrypted password manager.
- Avoid plain-text notes, cloud documents, and unencrypted screenshots.
- Do not keep the only recovery copy on the same device as the authenticator.
- Regenerate the 2FA enrollment if the secret may have been exposed.
- Use a hardware security key or passkey for important accounts when supported.
To understand why the secret can produce matching codes, read how 2FA and TOTP work.
Why does the generated code not match?
First confirm that you copied the correct secret and selected the correct account. Then enable automatic date, time, and time-zone settings on your device. Wait for a fresh code instead of submitting one at the end of its countdown. Our TOTP troubleshooting guide covers the checks in the safest order.
Frequently asked questions
Can I recover a secret from a six-digit code?
No practical account-recovery process should rely on deriving the secret from a displayed TOTP code. Use the provider’s official recovery options.
Is the QR code itself sensitive?
Yes. It normally contains the secret. Treat a screenshot of the setup QR code like a copy of the secret key.
Can the same key be used on two devices?
Technically, two authenticators configured with the same secret and time settings can generate matching codes. Whether you should do this depends on your security needs and organization policy. Secure recovery methods are often preferable to uncontrolled duplication.
Key takeaway
The 2FA secret is normally available when you configure an authenticator app. Reveal the manual setup option, handle the key as a credential, verify setup, and store recovery codes safely. If the original secret is gone, use official recovery and create a new 2FA enrollment rather than guessing.