What a 2FA setup key is
A setup key is the shared TOTP secret created by the service you are protecting. An authenticator app or browser tool combines that secret with the current time to generate the same short code the service expects.
How to use a 2FA setup key
A 2FA setup key is the shared secret behind authenticator codes. This guide explains where to find the manual key, how it relates to a QR code, which Base32 characters are valid, and how to use it with a local TOTP generator.
Setup key versus QR code
Most authenticator QR codes contain the same secret, usually inside an otpauth://totp/ URI. Manual entry uses the text setup key instead of scanning the QR code.
Base32 formatting
Manual setup keys are commonly Base32 strings using A-Z and 2-7. Spaces, hyphens, and padding may be shown for readability, but the TOTP calculation uses the normalized secret bytes.
When a setup key helps
A manual key is useful when a QR scanner is unavailable, when testing a TOTP integration, when moving a code between trusted devices, or when checking a recovery workflow.
URL shortcut safety
For shortcuts, prefer #secret=YOUR_BASE32_SECRET because the fragment remains in the browser. Path and query shortcuts still work, but those server-visible URLs are marked noindex.
What it cannot replace
A setup key is not a recovery code, password, push approval, SMS code, email code, passkey, or hardware security key response. It only works for TOTP-style authenticator codes.
Use a manual 2FA setup key
Open the account security settings
Go to the service where you are enabling two-factor authentication or multi-factor authentication, then choose the authenticator app or TOTP option.
Find the manual setup key
Look for text such as setup key, manual entry, unable to scan, or enter this key. Some services show only a QR code until you expand a manual option.
Copy the Base32 key or otpauth link
Copy the setup key exactly as shown, including spaces if you want the field to display it the same way. An otpauth://totp/ link can also be pasted directly.
Paste it into the generator
Paste the setup key into the local TOTP generator. The display can keep your original spacing while the calculation normalizes the Base32 secret internally.
Match any shown parameters
If the service shows algorithm, digits, or period values, use the same settings. Common defaults are SHA-1, 6 digits, and 30 seconds.
Enter the current code
Copy the current authenticator code back into the service to finish setup, then store the setup key only in places you trust.
Standards and references
FAQ
Where do I find my 2FA setup key?
Open the account's security or two-factor authentication setup page. Look for manual entry, setup key, or cannot scan QR code near the authenticator app setup step.
Is a setup key the same as a recovery code?
No. A setup key generates recurring TOTP codes. A recovery code is usually a one-time backup code used when you lose access to the authenticator.
Can I paste a setup key with spaces or hyphens?
Yes. This tool can preserve your pasted display text while normalizing spaces, hyphens, and padding for the Base32 calculation.
Why does my setup key say it is invalid?
The usual causes are copied characters outside A-Z and 2-7, missing characters, a wrong key type, or using a recovery code instead of the TOTP setup secret.
Does this work with Google Authenticator and Microsoft Authenticator keys?
It works with standard TOTP setup keys and otpauth://totp/ links used by many authenticator apps. It is compatible with those formats but not affiliated with Google or Microsoft.