Dai creatori di Abundera Sign

Free HOTP QR Code Generator

Build standard otpauth://hotp/ QR codes for counter-based authenticator apps and hardware tokens. Pure RFC 4226, no server, no signup.

0 / 900

I caricamenti locali rimangono nel tuo browser e appaiono solo sulla carta stampata. I dati QR utilizzano l'URL sopra.

Altri campi (opzionali)

Indirizzo

Profili social

Suggerimento: clicca con il tasto destro su Google Maps e copia le coordinate

Una bandiera svizzera rossa viene automaticamente sovrapposta al QR — richiesto dalle banche svizzere.

Incolla una fattura BOLT11 (lnbc...) o un indirizzo Lightning. Aggiungiamo il prefisso dello schema URI lightning: in modo che qualsiasi portafoglio Lightning possa scansionarlo.

Compatibile con Google Authenticator, Authy, 1Password, Bitwarden e qualsiasi app TOTP standard.

HOTP (RFC 4226) is the counter-based sibling of TOTP. Use it for hardware tokens like YubiKey OTP or for systems without reliable clocks. Same otpauth:// scheme; counter increments per code instead of advancing on time.

Codice di attivazione GSMA SGP.22 secondo LPA. iOS 17.4+ e Android 13+ li scansionano direttamente per provisionare profili eSIM.

Per RFC 3261, opens a SIP softphone (Linphone, Zoiper, Bria, etc.) and dials the address. sips: forces TLS for signalling. Works with Asterisk, FreeSWITCH, 3CX, and any standards-compliant PBX.

Opens the system MMS composer to send a multimedia message (text + image/audio/video attachment). Distinct from sms: in that the recipient receives an MMS-formatted message. iOS, Android and most carrier apps honour this scheme.

Paste the QR URL from your Alipay Receive Money page (Settings → My QR Code → Save). We pass it through verbatim. The Alipay app, AliPayHK, and any device with the Alipay+ scanner will recognise the URL or QR.

Personal receive codes start with wxp://f2f. Merchant codes are https://payapp.weixin.qq.com/... URLs from the Weixin Pay merchant portal. Paste either; we encode verbatim. The WeChat app and any Weixin-Pay-enabled scanner will resolve it.

Swish is Sweden's national P2P / merchant mobile-payment service. Payee can be a private mobile number (Swish-number) or a 1234-style merchant alias. The Swish app on iOS and Android scans the standard swish://payment?data=... URI.

Vipps is Norway's dominant mobile-payment app (now Vipps MobilePay across the Nordics). Send to phone emits a vipps://send?... deeplink for P2P; Merchant short-link wraps a https://qr.vipps.no/... URL.

Paste the link from your Mercado Pago Cobrar page (the https://mpago.la/..., https://link.mercadopago.com.br/..., or full mercadopago.com short-link). Works across MP apps in Argentina, Brazil, Mexico, Chile, Colombia, Uruguay and Peru.

Data Matrix is a square 2D matrix barcode (ISO/IEC 16022) used in healthcare, electronics, manufacturing, and direct-part marking. Holds up to ~2,335 alphanumeric characters in a single tag. Note: this is not a QR code — QR-only styling (eyes, dots, gradients, frames, logos) is disabled and the basic monochrome render is used.

Aztec Code (ISO/IEC 24778) is the 2D barcode used by airline boarding passes, train tickets, and electronic ID. Designed to scan well on phone screens and at low contrast. Holds up to ~3,067 alphanumeric characters. Not a QR; QR-only styling is disabled.

PDF417 (ISO/IEC 15438) is a stacked linear barcode used on US driver's licences, passports, FedEx airbills, and AAMVA-encoded ID cards. Holds up to ~1,800 ASCII characters. Not a QR; QR-only styling is disabled.

Use for legitimate purposes only: AAMVA parser testing, kiosk & age-gate development, accessibility tools, and demoing AAMVA workflows. Producing a counterfeit government ID is identity fraud and is prosecuted as a felony in every US state. Use real data only when you own the source license, or use synthetic data clearly marked as such.

Renders as a PDF417 barcode following the AAMVA Card Design Standard. Scan it back with this site's scanner to see the structured License Preview parser in action.

Code 128 (ISO/IEC 15417). Variable-length, high-density, encodes the full ASCII set. Used in shipping labels (UPS, FedEx, DHL all use it for their internal tracking), supply chain, and industrial labelling.

Code 39 (ISO/IEC 16388). The original alphanumeric barcode, supported by every scanner ever made. Used in healthcare patient bands, DOD military logistics (LOGMARS), and inventory tagging.

Code 93 — Symbol Technologies' more compact successor to Code 39. Mandatory two checksum characters (C and K) make it more reliable on scuffed labels.

Codabar (NW-7) — used by US blood banks, FedEx airbills (legacy), libraries (US/CA/EU), and photo finishing. Self-checking; does not require a check digit.

EAN-13 / GTIN-13 — global retail product identifier. Used outside North America (which uses UPC-A) on every retail consumer product. Use the 12-digit GS1 number; the 13th check digit is computed for you.

EAN-8 / GTIN-8 — compact retail product identifier for small packages where EAN-13 won't fit (chewing gum, batteries, etc.).

UPC-A / GTIN-12 — North American retail product identifier. Use the 11-digit GS1 number.

UPC-E — compact 8-digit zero-suppressed variant of UPC-A for small packages.

ITF-14 (Interleaved 2 of 5) — GS1's standard for shipping cartons / outer cases. Identifies the product inside (GTIN-14). Used by every major retailer and 3PL warehouse.

Vehicle Identification Number per ISO 3779. Encoded as a Code 39 barcode for compatibility with state DMV scanners, automotive registries, and insurance/title workflows. The 9th character is a check digit (auto-validated, not auto-computed — input invalid VINs are still encoded for testing).

Paste the link from your Payconiq merchant portal — typically https://payconiq.com/t/1/... for transactions or https://payconiq.com/l/1/... for static merchant QRs. Scanned by Payconiq, Bancontact, KBC Mobile, Belfius, ING, BNP Paribas Fortis, and most Benelux banking apps.

Codifica l'intera riga authorized_keys. Scansiona per copiare/incollare la chiave su una nuova macchina.

Per chiavi molto lunghe, usa rMQR orizzontale o suddividi in più QR. Il QR standard arriva fino a circa ~2 KB.

Le app ufficiali WireGuard per dispositivi mobili scansionano questi direttamente. Non includere mai la tua chiave privata in un QR stampato — solo per la condivisione digitale.

GS1 Digital Link è l'alternativa moderna e adatta al web al codice a barre EAN-13 per i prodotti al dettaglio. Il dominio del resolver predefinito è id.gs1.org, ma puoi usare il tuo.

Incolla il link di condivisione dall'app Spotify, o solo l'ID. Costruiamo l'URL open.spotify.com automaticamente.

Il formato dipende dalla piattaforma — per Mastodon usa @utente@istanza, per Bluesky usa handle.bsky.social, per Nostr incolla la chiave npub.

L'URI Geo (RFC 5870) si apre direttamente in qualsiasi app di mappe sul dispositivo — Google Maps, Apple Maps, OsmAnd, ecc. — senza scegliere un fornitore.

Link magnet BitTorrent standard. Scansionato da qualsiasi client BitTorrent che supporti i gestori di schema URI.

Incolla un payload iCalendar RFC 5545 completo — supporta più eventi, allarmi e regole ricorrenti. La maggior parte delle app di calendario importa il QR direttamente.

webcal:// URI that subscribes the scanner to a hosted .ics feed. Updates automatically as you publish new events.

Your entire bio page is encoded into the QR's URL hash — no backend, no account, no tracking. The /bio/ page decodes and renders it client-side.

Paste a YouTube video URL or just the 11-character video ID. We build a short youtu.be link that opens in the YouTube app or browser.

Opens the Apple Music app (or the web player) directly to the song, album, playlist, or artist. Storefront controls which country's catalog is used.

Find your Place ID at https://developers.google.com/maps/documentation/places/web-service/place-id. Scanning opens the Google Review dialog for your business.

The slug in your Yelp URL after /biz/. Scanning opens the Yelp Write A Review page.

The d + numeric ID from your TripAdvisor listing URL. Scanning opens the Write Review page.

Opens Venmo with your username pre-filled. Works on any device with the Venmo app installed.

Opens the Cash App with your $cashtag pre-filled.

Tip-jar QR that links to your Ko-fi, Patreon, Buy Me a Coffee, or Liberapay page. Pick the platform and enter your username.

TWINT URI that opens the Swiss TWINT app with your mobile number pre-filled. TWINT is the dominant Swiss mobile-payment app.

Bizum is Spain's dominant P2P mobile-payment service, used by every major Spanish bank. Scanning opens the bank app.

PayNow is Singapore's unified QR payment standard. Supports mobile number or UEN as the proxy.

Japanese JPQR unified QR payment standard. Accepted by PayPay, LINE Pay, Rakuten Pay, and 20+ Japanese payment apps.

Hong Kong Faster Payment System. Works with every Hong Kong retail bank and HKICL's FPS service.

DuitNow by PayNet — Malaysia's national real-time payment network. Works with all Malaysian retail banks and e-wallets.

MoMo e-wallet URI — Vietnam's most-used mobile payment app with 30+ million users.

PayID is Australia's instant-payment addressing service. Works with any NPP-enabled Australian bank app.

ZATCA / FATOORA is the Saudi Arabia mandatory e-invoice QR format required on every commercial invoice since 2021.

Unified BIP-21 URI combining an on-chain Bitcoin address and a Lightning invoice. Modern wallets pick Lightning when available and fall back to on-chain.

I caricamenti locali rimangono nel tuo browser e appaiono solo sulla carta stampata. I dati QR di MeCard non hanno un campo foto.

MeCard è un'alternativa più semplice a vCard, preferita da alcuni dispositivi Android

Altri campi (opzionali)

Indirizzo

0 caratteri

Capacità Micro QR: 35 cifre, 21 caratteri alfanumerici maiuscoli, o ~15 byte (minuscolo/URL). Ideale per codici brevi, numeri seriali e ID. Per gli URL, usa il QR standard.

La maggior parte delle fotocamere non può scansionare i codici Micro QR. Questo formato richiede scanner industriali specializzati (es. Scandit, Cognex). Usa il QR standard per la scansione generale.

Rectangular Micro QR — un formato stretto e largo, ideale per provette, braccialetti e strisce per biglietti. Fino a 361 caratteri.

La maggior parte delle fotocamere non può scansionare i codici rMQR. Questo formato richiede scanner industriali specializzati. Usa il QR standard per la scansione generale.

Questo formato di codice a barre viene renderizzato in monocromia solo con i colori di primo piano e sfondo. Modelli, forme di punti/occhi, sfumature, cornici e logo centrali si applicano solo ai codici QR e sono nascosti qui.

Mostra altri 30 modelli

Salva uno stile con il pulsante sopra per conservare i tuoi preferiti qui.

#000000
#FFFFFF

Oppure scegli un'icona predefinita:

Mostra altre 108 icone

Renderizzato dietro il QR con opacità ridotta. Forza automaticamente EC=H affinché il QR rimanga scansionabile attraverso la foto.

Generazione in batch

Carica un CSV per generare fino a 500 QR code in un unico batch. Ogni riga diventa il proprio QR: scegli un modello o personalizza 21 proprietà per riga: colori, cornici, stili di punti/occhi/pupille, gradienti, trasparenza, dimensioni, correzione errori, formato, logo integrato e molto altro.

21 colonne: type, data, filename, frametext, frame, template, fgcolor, bgcolor, size, ec, dotstyle, eyestyle, format, logo, gradient, g2, gtype, gangle, transparent, eyeball, eyecolor. Solo type e data sono obbligatori. Usa | per separare i campi all'interno di data (es. ssid|password|WPA).

Supportati tutti i 20 tipi di QR, inclusi URL, WiFi, vCard, MeCard, Email, SMS, Event, Location, UPI, SEPA, PayPal, Crypto, Micro QR e rMQR. Scarica il CSV di esempio per vedere tutte le colonne, i 40 modelli, gli 11 stili di cornice e i 12 loghi integrati in azione.

1. Scarica il CSV di esempio · 2. Modificalo in Google Sheets, Excel, Numbers o qualsiasi editor di testo · 3. Caricalo qui

Salva l'intero QR — tipo, tutti i valori dei campi, stile, frame, logo, design del biglietto da visita — come un singolo file .qr.json. Caricalo in seguito per ricreare tutto in un clic.

Ctrl+D Scarica PNG
Ctrl+Shift+D Scarica SVG
Ctrl+Shift+C Copia QR
Ctrl+P Stampa

Inserisci il contenuto per generare il tuo codice QR

Anche da Abundera

Firme elettroniche valide in tribunale

Abundera Sign va oltre le firme elettroniche di base. Ogni documento ottiene una prova crittografica, verifica indipendente e un pacchetto di prove a prova di manomissione.

  • Pacchetti di prove pronti per il tribunale generati automaticamente
  • Sigillo personale del documento — rileva immediatamente le manomissioni
  • Ancorato a 5 sistemi indipendenti — nessun singolo punto di guasto
Prova Abundera Sign

How HOTP Differs from TOTP

HOTP and TOTP both produce 6- to 8-digit one-time codes from a shared Base32 secret, and both use the same otpauth:// URI scheme. The single difference: TOTP advances the code on time (typically every 30 seconds), while HOTP advances on a counter that the client increments each time it generates a code. The server tracks the same counter and accepts codes within a small look-ahead window.

HOTP is the right choice when you can't trust the device clock, when the device has no clock (hardware tokens), or when codes need to remain valid until they are used (login flows where typing time matters). The trade-off is that the counter can drift if the user generates codes without submitting them — most servers handle this with a re-sync window of 10 to 50 codes.

Where HOTP shines

Fields explained

Privacy

The shared secret is sensitive. Abundera QR runs entirely in your browser — the secret never touches a server, never gets logged, never leaves your device. Generate on an offline laptop for maximum paranoia.

Disponibile in 26 lingue

Interfaccia completamente tradotta, rendering nativo della scrittura e supporto da destra a sinistra per arabo e urdu.

Frequently Asked Questions

Which apps and tokens can read these HOTP QR codes?

Any standards-compliant HOTP implementation: Aegis, Raivo, FreeOTP, FreeOTP+, KeePassXC, Yubico Authenticator, Token2 personalization tools, Protectimus desktop tools, and most modern enterprise IAM platforms (Okta, Auth0, Keycloak). Note: Google Authenticator quietly ignores the counter parameter and treats everything as TOTP — pick a different app for HOTP setups.

How is HOTP different from a YubiKey FIDO2 / WebAuthn key?

Different protocol entirely. HOTP is a shared-secret one-time-code scheme (RFC 4226). FIDO2/WebAuthn is asymmetric public-key authentication. Both are 'second factors' but FIDO2 is phishing-resistant where HOTP is not. HOTP is a fit when the relying party only supports OTP, or when you specifically need a code that can be typed.

What happens if the counter drifts out of sync?

Most servers accept codes within a look-ahead window (typically 10 codes) and resync the counter when a valid forward code arrives. If drift exceeds the window the user has to re-enroll. Some IAM platforms expose a 'resync' admin action that takes two consecutive codes to recompute the offset.

Why does Google Authenticator give wrong codes for HOTP QRs?

Google Authenticator treats every otpauth:// QR as TOTP regardless of the path. The codes it produces are valid TOTP codes against your secret — not HOTP codes — so the server rejects them. Use Aegis, Raivo, Yubico Authenticator, or a hardware token instead.

Can I program a YubiKey OTP slot from this QR?

Not directly. YubiKey OTP slots are programmed with the YubiKey Manager (GUI) or ykman (CLI). You can copy the Base32 secret from the form into ykman: ykman oath accounts add --type HOTP --algorithm SHA1 --digits 6 ISSUER:ACCOUNT <secret>.

What's the maximum counter value?

RFC 4226 allows counters up to 2^63 - 1. Practically, most implementations cap it lower (32-bit on legacy hardware). Hundreds of thousands of presses is fine on any modern token.

Should I use HOTP or TOTP for new deployments?

TOTP for almost everything. HOTP is the right pick only for: hardware tokens that lack a clock, deeply air-gapped environments, or single-use recovery codes. For phone-based 2FA, time-based codes are the standard and the user experience is significantly better.