TOTP otpauth URI Builder

You finished the TOTP work on the server, generated the base32 secret, and now you have to hand it to the user's app. Authenticator apps do not accept a bare secret: they expect a string shaped like otpauth://totp/, with an account label and parameters in the query. Forget the issuer or leave the email unescaped and the app either imports the account under the wrong name or refuses it without saying why.

The label is built as issuer:account, with each half percent-encoded on its own, and the issuer shows up a second time as a query parameter. That repetition is deliberate: older clients read the label prefix, newer ones read the parameter, and Google's key URI format recommends sending both. The secret is only checked against the base32 alphabet (A-Z, 2-7 and =), with spaces stripped and everything upper-cased. No length or checksum validation happens.

The page hands back the URI text, it does not draw a QR code, so copy the string into a QR generator when you build the enrollment screen. First make sure the secret matches exactly what your server stored, and replace the sample value JBSWY3DPEHPK3PXP, which is public and appears in every tutorial. The script makes no network calls at all: the URI is assembled in your browser and the secret never leaves it.