An authenticator QR can be a copy of your secret

The QR is not the same as a six-digit code

A normal TOTP setup QR often contains an otpauth URI: the secret key plus configuration such as account label, issuer, algorithm, digits, and period. Anyone who scans and keeps that key can calculate future verification codes until the original website rotates or removes that authenticator enrollment. The six- or eight-digit number displayed after setup, by contrast, is derived for a particular time window and is usually less reusable. Both can be abused, but the setup seed is the lasting exposure.

Google Authenticator's transfer/export QR may package multiple account secrets into one encoded migration payload, sometimes split across several QRs. Sharing a screenshot of such an export can disclose multiple independent account factors at once. Treat exported QR images as credential-bearing data, not routine pictures for troubleshooting.

Capture and decode within a controlled browser session

2FASync's supported QR import flows decode camera frames or local raster images in the browser. The design avoids uploading the raw QR image to a separate server decoder or an AI provider. Ask for camera permission only when you are ready to scan, review which browser tab is using it, and stop the camera when the import is complete. If you use an image file, first make sure it contains the intended export and that its storage location is under your control.

A browser-side decoder does not remove all risk: hostile browser extensions, malicious software, clipboard monitors, and an unlocked or shared device can still observe displayed secrets or imported data. Avoid remote screen sharing while sensitive QRs are visible. A complete batch, local preview, and explicit selection reduce avoidable mistakes but do not prove your device is free from compromise.

What to do with a QR screenshot afterward

If you created a temporary image solely to move an authenticator, check your device's screenshots folder, trash, cloud photo backups, and messaging apps. Delete unnecessary copies where you have control, but remember that deletion from one folder does not prove all previously uploaded or synchronized copies are gone. If an image was shared outside your trusted devices, assume the corresponding seed may have been exposed.

For a potentially exposed credential, visit the original website's security settings and consider re-enrolling or rotating the authenticator. Merely deleting the local image or removing a Vault entry does not revoke the website's original seed. Keep existing authorized backup factors until the replacement is tested successfully.

Don't use a third-party scanning website for debugging

A web-based generic QR decoder may need the image uploaded to its server, leaving you unable to assess how that long-lived secret is stored or logged. Copying the entire otpauth URI into search, support chat, bug trackers, or public forums creates similar risk. Even if you are trying to correct a simple issuer-label mismatch, the encoded string may contain the key that matters.

Record only the import source type, whether the UI says invalid, duplicate, or unsupported, the number of QR fragments detected, and a redacted view of non-sensitive account labels. Do not include the Base32 secret, the full otpauth URI, migration data parameter, recovery key, or readable QR screenshot when asking for help.

Recognize rejected and incomplete QR imports

A source QR can be valid as an image yet unsupported as an authenticator profile. 2FASync handles recognized TOTP entries, not counter-based HOTP or arbitrary proprietary versions. A complete Google export with several fragments must be assembled consistently; two fragments from different exports should not be combined. A duplicate entry is also not automatically a mistake: it may reveal that an account has been copied or relabeled.

Review the import preview, resolve warnings deliberately, and compare the resulting code against the original website before retiring a source device. The correct next step for a malformed or unsupported export is usually to revisit the original app and account settings, not to transform raw seed bytes through an unfamiliar converter.

Can someone use an authenticator setup QR after I close it?

Potentially yes. If it contains the reusable TOTP seed, a saved copy may generate future codes until you rotate the original site's authenticator enrollment.

Should I send a Google Authenticator export QR to support?

No. A migration QR can contain multiple long-lived secrets. Describe redacted error messages and batch status instead.