Check a TOTP profile before trusting a generated number

A bare Base32 secret has deliberate defaults

Entering a valid Base32 setup key without an otpauth URI tells the guest parser only the secret bytes. 2FASync applies the familiar defaults: TOTP, HMAC-SHA-1, six digits, and a 30-second time step. This is convenient for many setup screens, but it does not prove the original website uses those parameters. If a website explicitly specifies eight digits or a different algorithm, preserve that information through its supported setup URI or original enrollment instructions.

Base32 encodes a key; it is not an encryption scheme. Invalid characters, malformed padding, impossible lengths, or values that exceed the parser's safety limits are rejected. Never transform a questionable key through random online converters or ask support to inspect a real key. Check the original site's setup display and recopy the intended characters instead.

A valid otpauth TOTP URI carries configuration

The accepted TOTP URI format can describe an issuer, account label, secret, algorithm, number of digits, and time period. 2FASync validates the expected parameters strictly. It supports SHA-1, SHA-256, and SHA-512; six or eight digits; and an integer period within its bounded one-second to 86,400-second parser range. A period omitted from the URI defaults to 30 seconds. This is an input acceptance range, not a recommendation to configure unusually short or long codes.

Unknown or duplicate query parameters, invalid URI encodings, an issuer conflict between label and query, unrecognized algorithms, and unsupported digit values are reported rather than ignored. The source requires the otpauth type to be TOTP. Because different websites support different profiles, do not change parameters just to make a previously rejected URI pass validation.

Google migration payloads use a narrower profile

Google Authenticator migration exports are encoded differently from ordinary otpauth setup URIs. 2FASync recognizes supported TOTP records and maps its known algorithm and digit enumerations to SHA-1/256/512 and six or eight digits. The recognized migration format does not carry an independent time-period field, so imported TOTP entries use the specified 30-second migration profile. Unknown versions, unsupported algorithms, and malformed records are not silently accepted.

An export can consist of several QR fragments. A complete batch is required before its records can be treated as a coherent import. The preview distinguishes new, duplicate, unsupported, and invalid records so that the user can decide what to import. The ability to decode one exporter format does not guarantee support for every future proprietary Google Authenticator payload.

HOTP is not part of Vault import

HOTP uses a counter that changes when events occur, whereas TOTP uses a counter derived from time. The counter must remain synchronized with the original website's verifier. Treating a counter-based entry as a time-based one can produce numbers that look plausible but are never accepted. For this reason, 2FASync identifies HOTP types as unsupported and does not automatically convert them or import them into the member Vault.

If a required account uses HOTP, keep its existing working authenticator or ask the original service whether it supports a safe re-enrollment to TOTP. Do not discard the old credential after seeing an unsupported warning. Test any new factor on the original website with an alternate recovery method still available.

Verify with the site that owns the account

The best compatibility test is not merely whether 2FASync displays moving digits. It is whether the authentic website accepts the code generated from the exact setup information it supplied. Check the account label, system clock, algorithm, digits, and time step before attempting a new setup. If two entries share a label but different secrets, do not delete either until you identify which one the original website has enrolled.

A rejected code may result from clock drift, an expired window, an out-of-date enrollment or an unsupported profile. The troubleshooting guide gives a safe sequence for investigating those cases without sharing real OTPs or setup keys. If you are migrating, test the new entry before you retire the old device.

Does 2FASync support eight-digit TOTP codes?

Yes, for a supported otpauth TOTP URI or recognized migration profile that explicitly selects eight digits. Bare Base32 input defaults to six digits.

Can I use a TOTP time period longer than 30 seconds?

A valid otpauth URI can specify a bounded positive period supported by the parser, but the original website must use the same setting. The conventional default is 30 seconds.

Why does my HOTP QR fail to import?

HOTP's event counter differs from TOTP's time counter. 2FASync marks HOTP unsupported and does not convert it.