SHA256 hashing from QR code and import otp urls is setting to SHA1 on authenticator - so generating wrong TOTP

[Biswajit0180]

Describe the issue

Hello Team,

This issue happening on chrome, Firefox, Edge browser add-on.

SHA256 hashing from QR code and import otp urls is setting to SHA1 by Authenticator - so generating wrong TOTP, Please look into it.

But if manually entry the details and choosing SHA256, its working well.

Our user had reported this issue recently and when we debug found above issue.

Regards,
Biswajit

Browser

Chrome

Browser Version

chrome 138.0.7204.184, firefox 128.13.0esr, edge 138.0.3351.109

Extension Version

8.0.1

[Caceresenzo]

The issue was caused by an incorrect parsing of the OTP algorithm introduced in version 8.0.0 to enable this feature.

The code before (in v7.0.0):

Authenticator/src/models/storage.ts

Lines 383 to 384 in bf630cc

	data[hash].algorithm =
	data[hash].algorithm || OTPAlgorithm[OTPAlgorithm.SHA1];

The code after (in v8.0.0):

Authenticator/src/models/storage.ts

Lines 490 to 492 in 2cf9b0f

	algorithm: rawAlgorithm
	? (parseInt(rawAlgorithm) as OTPAlgorithm)
	: OTPAlgorithm.SHA1,

@mymindstorm parsed the algorithm-friendly name (SHA***) as an integer instead of casting the enum directly. This resulted in a NaN, which would be stripped during serialization.

Since SHA1 is now considered insecure, companies are likely using SHA256, which cannot be parsed and defaults to SHA1.

A simple fix would be:

  algorithm: rawAlgorithm 
-   ? (parseInt(rawAlgorithm) as OTPAlgorithm) 
+   ? OTPAlgorithm[rawAlgorithm]
    : OTPAlgorithm.SHA1, 

I will try to do a pull request to propose the fix.

[blib]

Hi @mymindstorm / @Sneezry — quick ping on a high-impact, low-effort fix.

There are bunch of issues like this shows that any non-SHA1 TOTP (e.g., SHA256/SHA512) is effectively broken: import/scan yields wrong codes and the extension-generated QR drops algorithm/period. 
PR #1451 fixes the root cause (v8.x parseInt on enum strings as NaN so it is set to defaults). It’s only a few lines and already reviewed. 

If you’re still willing to accept small maintenance, merging #1451 would immediately unblock many users.

Thank you very much for your consideration! I know you super busy and OSS stuff sucks a lot of time etc. if I can help in any way please just tell.