I have two accounts that won't show me the 2FA/MFA "Secret Key" used to generate the multifactor codes. Because of this, I am forced to use specific MFA apps rather than my preferred one. If I had the secret key, I could get rid of the other apps and use my preferred generator.

Given I have access to all the generated codes, is it possible to reverse the generation to obtain the secret key?

  • Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer.
    – Community Bot
    Apr 20 at 20:13

1 Answer 1


No, not if it's properly implemented.


2FA token apps are typically TOTP or HOTP which, at their core, are an HMAC with your token secret K and a counter C (which could be a timestamp in TOTP or an actual counter in HOTP).

HOTP(K, C) = truncate(HMAC(K, C)),

What you are describing is a known ciphertext attack, which HMAC is resistant to.


You could, of course do the brute force attack: capture an OTP value at a known time C and write a program to guess secret keys K until you get the same OTP, but expect that program will need to run for several centuries before it guesses correctly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.