Secret Key Google Authenticator Generator
I have changed my mobile phone and I have lost all the notes and Google Authenticator generator. Now I can not login into Joomla admin anymore as the secret key is required. How can I reset the website, so that I can access it again. Have a security key that plugs into a USB port and works with FIDO Universal 2nd Factor (U2F) or FIDO2. Important: If you’re using a Titan Security Key from Google, you can learn more about what computers and devices it’s compatible with. Always write down the recovery key when enabling 2FA (instead of scanning the QR code) then use the code you wrote down to add that key to your google authenticator. This verifies you wrote down the key correctly and also serves as your backup key in case you lose your phone. Google Authenticator uses two algorithms: HOTP and TOTP which are described in RFC 4226 and RFC 6238. These algorithms generate one-time passwords (OTPs) based on the secret key. To generate OTPs a secret needs to be shared between the server and the client. The secret key usually displays in the form of QR code.
Secret keys may be encoded in QR codes as a URI with the following format:
Examples
The solution is a QR code generator. Visit the page on your desktop and type the name, user and secret key, then point your mobile device at your monitor to scan the code into Google Authenticator (or whatever app you’re using to generate the six-digit codes). Client-side support can be enabled by sending authentication codes to users over SMS or email (HOTP) or, for TOTP, by instructing users to use Google Authenticator, Authy, or another compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan otpauth:// QR codes provided by PyOTP. Important: If you’re using a Titan Security Key from Google, you can learn more about what computers and devices it’s compatible with. Compatible phone’s built-in security key You may be able to use your phone’s built-in security key to help you securely sign in on a nearby device.
What Is Google Authenticator Key
Provision a TOTP key for user alice@google.com, to use with a service provided by Example, Inc:
This Base32 encoded key 'JBSWY3DPEHPK3PXP' has the value:
Here's another example with all optional parameters supplied
Live Demo
Try Browser Authenticator Demo, source at https://git.coolaj86.com/coolaj86/browser-authenticator.js
Valid types are hotp and totp, to distinguish whether the key will be usedfor counter-based HOTP or for TOTP.
The label is used to identify which account a key is associated with. It contains an accountname, which is a URI-encoded string, optionally prefixed by an issuer string identifyingthe provider or service managing that account. This issuer prefix can be used to preventcollisions between different accounts with different providers that might be identifiedusing the same account name, e.g. the user's email address.
The issuer prefix and account name should be separated by a literal or url-encoded colon,and optional spaces may precede the account name. Neither issuer nor account name maythemselves contain a colon. Represented in ABNF according to RFC 5234:
Valid values might include Example:alice@gmail.com, Provider1:Alice%20Smith orBig%20Corporation%3A%20alice%40bigco.com.
We recommend using both an issuer label prefix and an issuer parameter, described below.
Secret
REQUIRED: The secret parameter is an arbitrary key value encoded in Base32according to RFC 3548. /license-key-generator-with-registration-id.html. The padding specifiedin RFC 3548 section 2.2 is notrequired and should be omitted.
Issuer
Google Authenticator Barcode
STRONGLY RECOMMENDED: The issuer parameter is a string value indicatingthe provider or service this account is associated with, URL-encoded according toRFC 3986. If the issuer parameter is absent,issuer information may be taken from the issuer prefix of the label. If both issuerparameter and issuer label prefix are present, they should be equal.
Valid values corresponding to the label prefix examples above would be: issuer=Example,issuer=Provider1, and issuer=Big%20Corporation.
Older Google Authenticator implementations ignore the issuer parameter and rely uponthe issuer label prefix to disambiguate accounts. Newer implementations will use theissuer parameter for internal disambiguation, it will not be displayed to the user.We recommend using both issuer label prefix and issuer parameter together to safelysupport both old and new Google Authenticator versions.
Algorithm
OPTIONAL: The algorithm may have the values:
- SHA1 (Default)
- SHA256
- SHA512
Currently, the algorithm parameter is ignored by the Google Authenticator implementations.
Digits
OPTIONAL: The digits parameter may have the values 6 or 8, and determines howlong of a one-time passcode to display to the user. The default is 6.
Currently, on Android and Blackberry the digits parameter is ignored by the Google Authenticator implementation.
Counter
REQUIRED if type is hotp: The counter parameter is required when provisioninga key for use with HOTP. It will set the initial counter value.
Period
OPTIONAL only if type is totp: The period parameter defines a period that aTOTP code will be valid for, in seconds. The default value is 30.
Currently, the period parameter is ignored by the Google Authenticator implementations.
| #!/usr/bin/env python |
| # This Source Code Form is subject to the terms of the Mozilla Public |
| # License, v. 2.0. If a copy of the MPL was not distributed with this |
| # file, You can obtain one at http://mozilla.org/MPL/2.0/. |
| # Required packages (available from pip) : pyqrcode, pypng |
| importpyqrcode |
| importbase64 |
| importos |
| importbinascii |
| #We want a secret of at least 30 hex chars for security reasons |
| SECRET_LEN=30 |
| defconvert_secret_to_base32(secret): |
| returnbase64.b32encode(base64.b16decode(secret.upper())) |
| # Google authenticator format: |
| #otpauth://totp/[KEY NAME]?secret=[KEY SECRET, BASE 32]. |
| #'Myphone nr' for example, but it can be anything, a login/uid, etc. |
| keyname='4155701111' |
| #if you want to generate a code for non-Google (ie standard OATH Hex secret): |
| #secret = binascii.b2a_hex(os.urandom(SECRET_LEN)) |
| #For Google or Google-compatible authenticators: |
| secret=convert_secret_to_base32(binascii.b2a_hex(os.urandom(SECRET_LEN))) |
| #For HOTP, just replace totp by hotp ;-) |
| qrdata='otpauth://totp/{keyname}?secret={secret}'.format(keyname=keyname, secret=secret) |
| code=pyqrcode.create(qrdata) |
| # Generate on disk |
| code.png('code.png', scale=10) |
| # Generate in memory example: |
| # import io |
| # buffer = io.BytesIO() |
| # url.png(buffer) |
| # print('<img data='{}' />'.format(buffer.getvalue(()))) |