What Is a 2FA Secret Key? Base32, TOTP and otpauth URIs Explained

A 2FA secret key is the short string of letters and digits that an authenticator app turns into the six-digit code you type at login. If your order delivery includes one, it is the most important field in the line after the password, yet it is also the field buyers most often mistype or confuse with something else. This guide explains what the string is, what Base32 looks like, and how a secret compares with backup codes and QR payloads.

You will also learn how to spot a secret inside a delivery line and confirm in seconds that it works, so you can look at any string in your file and tell whether it is the secret, a backup code or something else.

What a 2FA secret key is and how it produces six-digit codes

Time-based one-time passwords (TOTP, defined in RFC 6238) are built from two ingredients: a shared secret and the current time. When 2FA is set up, the platform generates the secret and keeps a copy, and your authenticator app keeps the other copy. Every 30 seconds both sides run the same calculation on the secret and the clock, and both arrive at the same six digits.

That has three practical consequences:

• The secret is the account's second key. Anyone who holds it can generate valid codes from any device for as long as that 2FA setup stays active.
• Codes are not stored anywhere. Each code is recalculated every 30 seconds, so a screenshot of an old code is useless.
• The clock matters. If the device generating codes is a minute or more off real time, a correct secret still produces rejected codes.

Base32: what the characters look like and the usual typos

Secrets are written in Base32, an alphabet made of the 26 uppercase letters A to Z and the digits 2 to 7. That is the whole alphabet. The digits 0, 1, 8 and 9 never appear, and neither does punctuation. An illustrative example (not a real account key) looks like this: JBSWY3DPEHPK3PXP. Real secrets are commonly 16 to 32 characters long.

Because only 32 characters are valid, most typing errors are easy to catch:

• A 0, 1 or 8 in the middle of a secret means a character was misread. A 0 is usually the letter O, a 1 is usually the letter I or L, and an 8 is usually the letter B.
• Lowercase letters are normally fine, because most apps convert them.
• One or more "=" signs at the end are padding. Many apps accept the secret with or without them.
• Invisible extras such as a trailing space or line break copied from a text file often cause "invalid key" messages.

otpauth URIs, QR codes and plain text keys

The same secret can reach you in three forms, and mixing them up causes a lot of confusion:

• Plain text key. The Base32 string on its own. Authenticator apps call it a setup key or a manual entry key.
• QR code. A picture that encodes an otpauth URI so a phone can scan it instead of you typing the key.
• otpauth URI. A line of text that looks like otpauth://totp/Example:user?secret=JBSWY3DPEHPK3PXP&issuer=Example. The value after secret= is the Base32 key. The remaining parts are the label and settings such as issuer, algorithm, digits and period.

If you only have a QR image or an otpauth link, the secret is the text after secret= and before the next ampersand. Standard setups use SHA-1, six digits and a 30-second period, and an app assumes those defaults when you type only the secret. Scanning the QR code or importing the full URI also applies any non-default settings it contains.

2FA secret key, backup codes and recovery email

These three items protect the same account but do completely different jobs:

• 2FA secret key. A long-lived Base32 string that generates a new code every 30 seconds. It changes only when 2FA is reset or set up again.
• Backup codes. One-time codes a platform may offer for the day you cannot reach your authenticator. Each works once. They are not Base32 secrets, so an authenticator app or a TOTP tool cannot use them.
• Recovery email. An inbox, not a code. It receives login confirmations and reset links. In a delivery line it appears as an email address, usually followed by that mailbox's own password.

The secret generates your daily codes, backup codes are the spare tire, and the recovery email is the way back in when something else breaks. Label them separately in your records.

Finding the secret in a delivery line and testing it

Deliveries arrive as a TXT file with lines such as username:password:email:email_password:auth_token, and the exact fields vary by category. When a category includes a 2FA key, it is one more field in that line. Do not count positions blindly: read the category description, then compare it with the first line of your file.

You can also recognise fields by their shape:

• The secret is 16 or more characters, uppercase letters and the digits 2 to 7, with no punctuation.
• The auth_token is a long hexadecimal string. It is a session token, not a code generator, and it cannot replace the secret. For that workflow see logging in to Twitter with an auth token.
• Passwords can contain a colon, which is why naive splitting on ":" sometimes breaks a line.

To check that every line follows the same layout, paste a sample into the format identifier. To pull out just the column that holds the secrets, use split-by-delimiter.

Then test the secret in seconds. Open the free 2FA tool, paste the secret and a six-digit code appears with a countdown. If the tool reports an invalid secret, go back to the typo list above. If a code appears but the login rejects it, check your device clock and follow what to do when a 2FA code is not working.

Storing secrets safely when you manage many accounts

A delivery line often holds the password and the 2FA secret together, so anyone who opens the file has both factors. Protect the file as a whole rather than each field separately:

• Keep the file in one private folder with limited access, and avoid chat apps, shared documents or screenshots.
• Test every secret soon after delivery and note the date next to the account, so a problem shows up early.
• Label what each string is, so a one-time backup code never ends up in an authenticator app.
• Count your copies. Loading the same secret into a second authenticator app is a reasonable backup, but each copy is another place it can leak.

For a wider plan, read two-factor authentication and recovery planning, and for listing vocabulary see the account glossary. When you compare categories such as Phone Verified Aged Accounts, read the description to see what a delivery file contains. If you rely on a 2FA key, confirm that before you order, or ask support on Telegram.

Frequently asked questions

What does a 2FA secret key look like?

It is a string of uppercase letters A to Z and digits 2 to 7, usually 16 to 32 characters long, for example JBSWY3DPEHPK3PXP in documentation examples. Some platforms show it in groups separated by spaces or dashes.

Is the 2FA secret the same as a backup code?

No. The secret generates a new code every 30 seconds for as long as that 2FA setup stays active. A backup code is a one-time code that works once and cannot be used in an authenticator app.

Can I turn a QR code into a secret key?

Yes. A setup QR code encodes an otpauth URI, and the secret is the value after secret= in that text. Keep that text private, because it is as sensitive as the key itself.

Why do some secrets have spaces or dashes?

The spacing is only for readability, often in groups of four characters. If an app rejects the key, remove the spaces and dashes; the free 2FA tool accepts them as they are.

Can the same secret be used in two apps at once?

Yes. Any app or device that holds the same secret and has a correct clock shows the same code. That is handy as a backup, but each copy is another place where the secret can be exposed.