5

I have the below QR code generated from my application so users can use their phones for a time-based OTP. For Google Authenticator in iOS, scanning the QR code correctly leads to an eight-character time-based OTP generating every 30 seconds. However, on the exact same Google Authenticator in Android, it incorrectly generates a six-character string instead.

I have provided the sample string and QR code below (it's from a test system) - does anyone know why the implementation of the functionality differs between the exact same app on Android and iOS, or alternatively where I can find developer documentation for either the otpauth protocol or Google Authenticator itself (both seem thin on the ground and I've had to take what I can from tutorials)?

Sample string: otpauth://totp/test@email.com?secret=GQ2DOMBXGRCDCMRSIVBEEOJSGMZEEQ2F&issuer=TestApplication&algorithm=SHA256&digits=8&period=30

Sample QR Code:

0
9

While the Play Store version of Google Authenticator is proprietary, there is also an open-source version.

Browsing through its wiki for Key Uri Format, there is a remark for digits parameter.

Digits

OPTIONAL: The digits parameter may have the values 6 or 8, and determines how long of a one-time passcode to display to the user. The default is 6.

Currently, on Android and Blackberry the digits parameter is ignored by the Google Authenticator implementation.

So, apparently, the digits parameter is ignored in the Android version (along with other optional parameters like algorithm and period that are ignored on all platforms).

As far as I have tried searching for the specific reason why it is not implemented, I could not find it.

1
  • Thanks for that - what an odd thing to be different between the two versions. I'll mark this as the accepted answer. Looks like we'll be recommending a different app to our users that works properly across both platforms...
    – Thomas
    Dec 1 '21 at 4:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.