Otpauth

972 stars
ISC
Active this week
Last commit today

Last verified Nov 9, 2026

Parse Google Authenticator's otpauth-migration:// export links into standard otpauth:// URIs, with QR code generation and live OTP evaluation.

Visit website GitHub972 Deploy on Hostinger

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who Otpauth is for#

Migrating from Google Authenticator to another app

Export accounts from Google Authenticator using Transfer Accounts, extract the migration QR with any QR reader, and run `otpauth -link <link>` to get one standard `otpauth://` URI per account. Import the URIs into your new authenticator app.

Skip if:

You are already using an authenticator that exports standard otpauth:// URIs natively.

Backing up TOTP secrets in a portable format

Run `otpauth -qr -link <link>` to generate QR code PNGs for each account. Store the PNGs or the text URIs in an encrypted backup. These are scannable by any TOTP app if you need to restore access on a new device.

Skip if:

Your authenticator already stores an encrypted backup with an open export format.

Setting up a self-hosted 2FA stack

Use Otpauth to extract secrets from Google Authenticator in `otpauth://` format, then import them into a self-hosted authenticator or secrets manager. The standard URI format is accepted by virtually every TOTP tool.

Skip if:

You have no existing Google Authenticator accounts to migrate.

Verifying secrets before switching apps

Run `otpauth -eval -link <link>` to compute live TOTP values for each decoded account and compare them against your existing authenticator. This confirms the secrets decoded correctly before you switch tools and potentially lose access.

Skip if:

You are scripting an automated migration with no interactive verification step.

the problem

The problem it solves#

Google Authenticator has no built-in export mechanism that produces portable, human-readable secrets. The 'Transfer accounts' feature generates QR codes that encode an otpauth-migration://offline?data=... URI, a protobuf-based format that standard TOTP importers cannot read. Users who want to move to a different authenticator app, back up their secrets, or import accounts into a self-hosted tool are left without a direct path: Google provides no conversion utility.

The practical result is that your TOTP secrets are trapped in Google Authenticator unless you re-scan every original setup QR code from scratch. For accounts where the original QR code is no longer available, which is common for older accounts or accounts set up with temporary access codes, re-scanning is not possible.

how Otpauth solves it

How it solves it#

Migration link decoder

Takes an `otpauth-migration://offline?data=...` URI exported by Google Authenticator and outputs one standard `otpauth://totp/...` URI per account. Decodes the protobuf payload using the same format Google uses internally. Pass the link with the `-link` flag.

QR code generation

With the `-qr` flag, writes one PNG QR code per decoded account to the working directory. Each QR code encodes a standard `otpauth://` URI, scannable by any TOTP app. Useful for migrating to an authenticator that imports via QR scan rather than text URI.

Local HTTP server

The `-http` flag starts a web server (for example, on `localhost:6060`) that displays decoded accounts in a browser. Useful for reviewing results visually or for teams running the Docker image on a shared server. The Docker image maps port 6060 by default.

Live OTP evaluation

The `-eval` flag computes and prints the current TOTP value for each decoded account, so you can verify secrets are correct before importing them elsewhere. No separate authenticator app is needed to sanity-check the output.

Reverse conversion

The `-rev` flag reverses the direction: takes a set of standard `otpauth://` URIs and re-encodes them as an `otpauth-migration://` QR code. Useful for restoring accounts from backup into Google Authenticator or generating a migration QR from an existing set of secrets.

Prototext dump and batch info

The `-dump` flag outputs the raw protobuf data as human-readable prototext, exposing fields like version, batch size, and batch index. The `-info` flag prints only the batch metadata without exposing the account secrets.

strengths · trade-offs

Strengths and trade-offs#

Strengths

ISC licenseISC is a permissive OSI-approved license equivalent to two-clause BSD. You can use, modify, and distribute Otpauth freely, including in commercial tools and internal scripts, without copyleft restrictions. The only requirement is preserving the copyright notice and license text if you redistribute the binary or source.
Single binary with no runtime dependenciesThe compiled Go binary runs on Linux, macOS, and Windows without installing a database, a background service, or a language runtime. Deployment is a file copy or a one-line `go install` command.
Actively maintainedThe repository received a push on November 8, 2026. With 972 GitHub stars, 85 forks, and only 5 open issues, the project remains responsive to bug reports and shows consistent maintenance activity.
Docker image availableAn official Docker image (`ghcr.io/dim13/otpauth:latest`) is available from the GitHub Container Registry. It supports the full flag set, including the HTTP server and working directory mount, so it runs in containerized workflows without installing Go.

Trade-offs

-Manual QR extraction step requiredOtpauth takes a text link, not a camera feed. You need a separate QR reader (a phone app, a desktop tool, or a screen reader) to decode Google Authenticator's export QR into the raw `otpauth-migration://offline?data=...` text before passing it to the tool. This step is not automated.
-Migration aid only, not a full 2FA managerOtpauth converts existing secrets and generates QR codes; it does not store secrets, sync across devices, send OTP push notifications, or manage ongoing TOTP sessions. Users who want a full 2FA management tool need a separate application after migration.
-5 open issuesThe repository has 5 open issues (from the GitHub issues API). For a focused utility of this scope that number is low, but it is worth checking the issue tracker before using the tool in a production migration script.

versus alternatives

Otpauth vs alternatives#

Authy

Authy is a commercial multi-device authenticator app that backs up your TOTP secrets to its cloud with encryption, enabling cross-device restore without re-scanning QR codes. Authy's backup format is proprietary; there is no official export path to standard otpauth:// URIs, so migrating away from Authy has the same portability problem as migrating away from Google Authenticator. Otpauth does not replace Authy as a day-to-day authenticator. It handles only the Google Authenticator migration format, producing standard otpauth:// URIs you can import into whichever app you choose next, including free open source ones.

1Password Authenticator

1Password is a paid password manager that includes TOTP account management within its vault. It accepts otpauth:// URIs on import, which makes Otpauth a useful step if you want to consolidate your Google Authenticator accounts into 1Password: run Otpauth on the migration link, then paste the resulting URIs into 1Password's TOTP importer. For users who prefer no cloud dependency and no subscription, Otpauth combined with a self-hosted or local 2FA manager covers the same use case without ongoing fees.

When to Choose Otpauth

Otpauth is a one-shot migration and backup tool. It is the right choice when you need to decode Google Authenticator's migration format, generate portable QR codes from existing accounts, or verify secrets before switching apps. Compared to commercial 2FA platforms that handle authentication as a managed cloud service, Otpauth has no subscription, no cloud storage, and no ongoing management UI. It converts a migration link to standard URIs and exits.

install · quick start

Quick start#

bash

Install the binary using the Go toolchain.
```bash
go install github.com/dim13/otpauth@latest
```

tech stack · detected from GitHub

What it's built on#

Languages: GoJavaScript

frequently asked

FAQ#

How do I get the migration link from Google Authenticator?

Open Google Authenticator on your phone, tap the three-dot menu, choose 'Transfer accounts', then 'Export accounts'. Select the accounts you want to export, and a QR code appears. Use any QR reader app (a phone camera app with QR support, or a desktop QR scanner) to decode the QR into its raw text. The text will start with otpauth-migration://offline?data=. Pass that string to otpauth with the -link flag.

What is the ISC license and what can I do with this tool?

ISC is a permissive OSI-approved open source license. You can use Otpauth in personal projects, internal business tools, and commercial products without paying a fee or releasing your own code. The only requirement is preserving the copyright notice and license text if you redistribute the binary or source. There are no copyleft or network-distribution restrictions.

Can I run Otpauth without installing Go?

Yes. Prebuilt binary releases are available at https://github.com/dim13/otpauth/releases/latest for multiple platforms. Download the binary for your platform, make it executable (chmod +x on Linux or macOS), and run it directly. A Docker image (ghcr.io/dim13/otpauth:latest) is also available if you prefer a container.

Does Otpauth store or transmit my TOTP secrets?

No. Otpauth is a local command-line tool that processes its input in memory and writes output to stdout or to QR PNG files in the working directory. It makes no network requests beyond serving the optional local HTTP interface when -http is passed. Your secrets never leave the machine unless you redirect the output yourself.

What is the -rev flag for?

The -rev flag reverses the conversion: it takes standard otpauth:// URIs and encodes them back into an otpauth-migration:// QR code. This is useful if you have a set of otpauth:// URIs from a backup or another tool and want to restore them into Google Authenticator, or if you want to generate a migration QR for sharing accounts between devices.

also worth a look