Extract TOTP/HOTP secret keys from Google Authenticator

Extract two-factor authentication (2FA, TFA) secret keys from export QR codes of "Google Authenticator" app. The secret and otp values can be printed and exported to json or csv. The QR codes can be printed or saved as PNG images.

Usage

Open "Google Authenticator" app on the mobile phone
Export the QR codes from "Google Authenticator" app
Read QR codes with a QR code reader (e.g. from another phone)
Save the captured QR codes in the QR code reader to a text file, e.g. example_export.txt. Save each QR code on a new line. (The captured QR codes look like otpauth-migration://offline?data=...)
Transfer the file to the computer where his script is installed.

Call this script with the file as input:

 python extract_otp_secret_keys.py example_export.txt

Program help: arguments and options

usage: extract_otp_secret_keys.py [-h] [--json FILE] [--csv FILE] [--printqr] [--saveqr DIR] [--verbose] [--quiet] infile

positional arguments:
  infile                file or - for stdin (default: -) with "otpauth-migration://..." URLs separated by newlines, lines starting with # are ignored

options:
  -h, --help            show this help message and exit
  --json FILE, -j FILE  export to json file
  --csv FILE, -c FILE   export to csv file
  --printqr, -p         print QR code(s) as text to the terminal (requires qrcode module)
  --saveqr DIR, -s DIR  save QR code(s) as images to the given folder (requires qrcode module)
  --verbose, -v         verbose output
  --quiet, -q           no stdout output

Dependencies

pip install -r requirements.txt

Known to work with

Python 3.10.8, protobuf 4.21.9, qrcode 7.3.1, and pillow 9.2
Python 3.11.0, protobuf 4.21.9, qrcode 7.3.1, and pillow 9.2

For protobuf versions 3.14.0 or similar or Python 3.6, use the extract_otp_secret_keys version 1.4.0.

Optional

For printing QR codes, the qrcode module is required, otherwise it can be omitted.

pip install qrcode[pil]

Technical background

The export QR code of "Google Authenticator" contains the URL otpauth-migration://offline?data=.... The data parameter is a base64 encoded proto3 message (Google Protocol Buffers).

Command for regeneration of Python code from proto3 message definition file (only necessary in case of changes of the proto3 message definition or new protobuf versions):

protoc --python_out=protobuf_generated_python google_auth.proto

The generated protobuf Python code was generated by protoc 21.9 (https://github.com/protocolbuffers/protobuf/releases/tag/v21.9).

References

Proto3 documentation: https://developers.google.com/protocol-buffers/docs/pythontutorial
Template code: beemdevelopment/Aegis#406

Alternative installation methods

pipenv

You can you use Pipenv for running extract_otp_secret_keys.

pipenv install
pipenv shell
python extract_otp_secret_keys.py example_export.txt

Visual Studio Code Remote - Containers / VSCode devcontainer

You can you use VSCode devcontainer for running extract_otp_secret_keys.

Requirement: Docker

Start VSCode
Open extract_otp_secret_keys.code-workspace
Open VSCode command palette (Ctrl-Shift-P)
Type command "Remote-Containers: Reopen in Container"
Open integrated bash terminal in VSCode
Execute: python extract_otp_secret_keys.py example_export.txt

venv

Alternatively, you can use a python virtual env for the dependencies:

python -m venv venv
. venv/bin/activate
pip install -r requirements-dev.txt
pip install -r requirements.txt

The requirements*.txt files contain all the dependencies (also the optional ones). To leave the python virtual env just call deactivate.

devbox

Install devbox, which is a wrapper for nix. Then enter the environment with Python and the packages installed with:

devbox shell

Tests

PyTest

There are basic pytests, see test_extract_otp_secret_keys_pytest.py.

Run tests:

pytest

python -m pytest

unittest

There are basic unittests, see test_extract_otp_secret_keys_unittest.py.