I've noticed that upon generating a new TOTP (for Google), the string occasionally switches the secret & issuer causing the QR generation to break (with qrious).
These generate two visibly different QR codes, and only one of them successfully scans.
Working with qrious:
otpauth://totp/Company:name%domain.com?secret=2345ABCD6789EFGH&issuer=Company
Not Working with qrious:
otpauth://totp/Company:name%domain.com?issuer=Company&secret=2345ABCD6789EFGH
There is no specific order listed here, just that they are query parameters. It does affect how the QR is drawn though.
edit: It was pointed out to me that 0 & 1 technically do not show up in RFC 4648 base32, so I adjusted the base32 example strings.
I've noticed that upon generating a new TOTP (for Google), the string occasionally switches the secret & issuer causing the QR generation to break (with qrious).
These generate two visibly different QR codes, and only one of them successfully scans.
Working with qrious:
otpauth://totp/Company:name%domain.com?secret=2345ABCD6789EFGH&issuer=Company
Not Working with qrious:
otpauth://totp/Company:name%domain.com?issuer=Company&secret=2345ABCD6789EFGH
There is no specific order listed here, just that they are query parameters. It does affect how the QR is drawn though.
edit: It was pointed out to me that 0 & 1 technically do not show up in RFC 4648 base32, so I adjusted the base32 example strings.