scito/extract_otp_secrets

Extract one time password (OTP) secrets from QR codes exported by two-factor authentication (2FA) apps such as "Google Authenticator". The exported QR codes from authentication apps can be captured by camera, read from images, or read from text files. The secrets can be exported to JSON or CSV, or printed as QR codes to console. observed · 2026-08-28

github.com/scito/extract_otp_secrets · homepage · Python · GPL-3.0 (copyleft) observed · 2026-08-28

Health v2 · maintenance only

93/100

Activity 99
Release rhythm 82
Longevity 100

How is this computed?

round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-02. Adoption (stars, forks) is never an input.

gap_med: 48.0
age_days: 2293
days_rel: 40
days_push: 7
n_releases_24m: 13

Full methodology

Adoption not part of the score

1647 stars · 162 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Python CLI tool that extracts one-time password (TOTP/HOTP) secrets from QR codes exported by two-factor authentication apps like Google Authenticator. It reads QR codes from camera capture, image files, or text files, and exports the secrets to JSON, CSV, or as QR codes printed to console or saved as PNG.

Use cases

extract otp secrets from google authenticator export qr codes
recover 2fa secret keys after losing my phone
backup google authenticator accounts to json or csv
decode otpauth-migration qr code data
migrate two-factor accounts between phones
read totp secrets from qr code images
print otp secrets as qr codes to console

When to choose

you need to back up or migrate 2FA secrets from Google Authenticator export QR codes
you want offline, scriptable extraction of OTP secrets with JSON/CSV output
you need cross-platform recovery of TOTP/HOTP keys from images, camera, or text files

When to avoid

you need a GUI-first password manager or authenticator app rather than a CLI extraction tool
your 2FA app does not support QR export or uses a non-otpauth-migration format
extracting secrets from devices you do not own - this is for legitimate account recovery only

Facets

cli-tool · maturity active

security parser cli serialization image-processing security privacy developer-tools python windows cli cross-platform otp totp hotp 2fa google-authenticator qr-code otpauth protobuf backup recovery mfa command-line linux macos docker

3 sources

readme: https://github.com/scito/extract_otp_secrets · fetched 2026-08-28 · 4bc02f4797b7
homepage: https://scito.ch/content/extract-secret-keys-google-authenticator-qr-export · fetched 2026-08-29 · 174d943c794f
site_page: https://scito.ch/content/about · fetched 2026-08-29 · 2ee695f51f13

Member repositories

Repository	Role	Health v2
scito/extract_otp_secrets	main	93

For agents

markdown · JSON · MCP: product_card(name="scito/extract_otp_secrets")

Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem