# extract_otp_secrets for Extracting OTP Backup QR Codes

> extract_otp_secrets is a Python utility for extracting TOTP and HOTP secrets from QR codes exported by two-factor authentication apps. It supports camera capture, image files, text files, JSON, CSV, and console QR output.

**scito/extract_otp_secrets** — Extract one time password (OTP) secrets from QR codes exported by two-factor authentication (2FA) apps such as "Google Authenticator". The exported QR codes from authentication apps can be captured by camera, read from images, or read from text files. The secrets can be exported to JSON or CSV, or printed as QR codes to console.

- Repository: https://github.com/scito/extract_otp_secrets
- Website: https://scito.ch/content/extract-secret-keys-google-authenticator-qr-export
- Stars: 1,686 · Forks: 161
- Language: Python
- License: GPL-3.0
- Published: 2026-10-16 · Updated: 2026-10-16 · Language: en
- Canonical page: https://hysenlabs.com/projects/scito-extract-otp-secrets

## What extract_otp_secrets Recovers

extract_otp_secrets addresses a narrow but consequential problem: moving OTP secrets out of QR codes created by two-factor authentication applications such as Google Authenticator. The README describes exported QR codes as the input, not ordinary account passwords or tokens generated by a service. The project targets TOTP and HOTP data, including secrets needed for backup, recovery, or transfer to another authenticator. That makes it relevant to people changing phones, restoring an authenticator, administering a personal account, or preserving access to accounts whose second factor is no longer available. It is not an authentication client. It does not contact Google or another service to validate an account, and its documented output is extracted OTP data rather than a login session. This distinction matters because the project handles data that can allow someone to generate valid one-time passwords. Its use is therefore tied to controlled recovery work, not routine sign-in. The README does not describe a hosted service, shared workspace, or automatic synchronization between users.

## Camera, Image, and Text Input in extract_otp_secrets

The project provides three documented ways to supply QR data. A system camera can capture exported QR codes through a graphical interface. Existing image files can be read using the built-in QR decoder. Alternatively, a text file containing data generated by a third-party QR reader can be supplied. These paths address different starting points. Camera capture is useful when the QR code is displayed on another screen or held in view of a computer camera. Image input suits a saved screenshot or exported picture. Text input assumes that another QR reader has already decoded the visual symbol into its payload. After decoding, the script extracts OTP secrets from the QR data. The output can be JSON or CSV, and the project can also print QR codes to the console or save them as PNG files. The repository contains an example export image, an example export text file, example CSV and JSON outputs, and separate KeePass-oriented CSV examples. Those files demonstrate supported data paths, but the README does not describe automatic cloud transfer, backup synchronization, or secure storage.

## Installing the extract_otp_secrets Executable

Download the appropriate asset from the latest GitHub release. On Linux and macOS, the README documents changing its execute permission before starting it. The user should see the program launch without a separate Python installation. The documentation notes that startup may be delayed because the executable first unpacks internal files.

## Starting Recovery with One Exported QR Code

Start with one exported QR code when confirming that the tool is configured correctly. The README separates camera capture, built-in image decoding, and third-party text decoding into different usage categories, but the excerpt does not show the exact command-line flags for those operations. For that reason, the documented first step is to launch the downloaded executable and use the applicable input path. A reader should see decoded OTP data rendered according to the selected output mode. The documented destinations are JSON, CSV, console QR codes, and PNG QR images. Do not paste a real secret into a public issue, chat message, or source repository. JSON and CSV expose the secret as text. A console QR code carries it in visual form, and a PNG persists it as a copyable image. The README does not state that the project encrypts any output. If a QR code cannot be decoded, the documentation provides no repair command or recovery guarantee. Obtaining a cleaner original export is the appropriate next step rather than assuming that the account configuration is gone.

## extract_otp_secrets JSON, CSV, and KeePass Outputs

JSON is suited to structured storage and later processing, while CSV provides a tabular representation for records and spreadsheet-oriented workflows. The README lists both destinations, and the repository includes example files for them. It also documents KeePass output examples with separate TOTP and HOTP CSV files. KeePass support is therefore an intended export pattern, not a claim that the project manages a KeePass database or completes an entire backup. Console QR output can be scanned or visually transferred, while PNG output creates an image file from generated QR data. Each representation carries the same sensitive authentication capability. JSON and CSV expose that capability as text, while image outputs make copied backups easy to create. The README does not document temporary-file deletion, automatic expiration, secure deletion, or encryption at rest. File-system permissions, disk encryption, access control, and retention policy therefore need to be handled outside the script. The repository's example output files should not be mistaken for demonstration accounts that readers can adopt safely.

## Python Dependencies, Releases, and Upgrade Cost

The Python project targets Python 3.10 through 3.14, as shown in the README and project classifiers. Its dependencies include `opencv-contrib-python==5.0.0.93`, `protobuf==7.36.2`, `pyzbar`, `qrcode`, `qreader>=3.16,<4.0`, Pillow, colorama, and version-constrained NumPy releases. The repository also includes `requirements.txt`, `pyproject.toml`, `Pipfile`, `Pipfile.lock`, `uv.lock`, tests, and Docker-related files. This gives developers several documented packaging paths, including Python installation methods, a development container, Docker, and executable builds. Release v2.13.0 requires Python 3.10. Release v2.14.0 lists qrcode 3 and OpenCV 5.0 dependency updates and adds macOS arm64 binaries. The repository is not archived, and the last push was on 2026-10-14. Upgrade cost is not zero because pinned dependencies and Python-specific NumPy constraints can require environment work when supported versions change. The GPL-3.0 license is relevant when redistributing the program or incorporating it into another project, although this article does not provide legal advice.

## Security Boundaries and Alternative Migration Paths

The main limitation is inherent to the task. A QR export concentrates authentication capability. Anyone who obtains the extracted secret may be able to generate OTP codes for the corresponding account, depending on account settings and secret validity. The README does not document encryption at rest, secure deletion, remote revocation, or protection against a compromised host. Camera capture adds a physical capture step, while image and text input depend on the quality and integrity of the exported source. The project is the wrong tool for a user who has not lost authenticator access, or for an organization that requires a centrally audited migration process. A manual transfer between official authenticator applications is a different approach because it does not require reading the QR payload into a separate extraction utility. A password manager with documented OTP import support is another alternative when it accepts the relevant format directly. That can avoid an extra conversion step, but compatibility depends on the particular password manager and account type. The README does not claim that an alternative supports every Google Authenticator export.

## What extract_otp_secrets Tests Do Not Guarantee

Based on the repository layout, this is a developed Python project rather than a single undocumented script. It contains `tests/`, `pytest.ini`, `run_pytest.sh`, static-analysis configuration, and GitHub Actions workflow directories. The README displays a coverage badge, but it does not provide test commands or results, so this review cannot make a claim about pass rate or QR recognition accuracy. Release history shows changes to major decoding dependencies, which may affect installation and recognition behavior. A sensible first verification is to use one test account export, select one documented input route, and compare the resulting JSON, CSV, or QR output with the source QR data. The README does not document rollback, OTP secret revocation, or a recovery procedure after an incorrect output file has been created. Those are operational boundaries. Files containing extracted secrets require a defined storage location, restricted access, and a removal step after migration.

## Conclusion

Use extract_otp_secrets when you already have exported 2FA QR codes and need to recover their OTP secrets for a controlled backup or migration. It is a poor fit for ordinary users who only need to authenticate, or for anyone who cannot safely store secret exports. Before adoption, verify the Python version, inspect the chosen output format, confirm that the destination is encrypted and access-controlled, and test recovery on a non-production account. The first concrete decision is whether the self-contained executable or the Python script fits the target machine.

## FAQ

### Can extract_otp_secrets read QR codes from Google Authenticator exports?

Yes. The README says the project extracts OTP secrets from QR codes exported by two-factor authentication apps such as Google Authenticator. It supports camera capture, image files, and text files generated by a third-party QR reader.

### Which output formats does extract_otp_secrets support?

The documented outputs include JSON and CSV files, QR codes printed to the console, and PNG files. The repository also includes separate KeePass-oriented TOTP and HOTP CSV examples.

### Does extract_otp_secrets require Python?

The README says downloadable executables are self-contained and require neither Python nor dependencies. For developers, the project provides Python installation methods and supports Python 3.10 through 3.14.

## Sources

- [License: GPL-3.0](https://github.com/scito/extract_otp_secrets/blob/master/LICENSE)
- [Project website](https://scito.ch/content/extract-secret-keys-google-authenticator-qr-export)
- [README](https://github.com/scito/extract_otp_secrets/blob/master/README.md)
- [Releases](https://github.com/scito/extract_otp_secrets/releases)
- [scito/extract_otp_secrets on GitHub](https://github.com/scito/extract_otp_secrets)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/scito-extract-otp-secrets