Why TimeOtp-Secret-Base32 is shown in clear in the details pane of keepass?

A lightweight and easy-to-use password manager

Brought to you by: dreichl

#2415 Why TimeOtp-Secret-Base32 is shown in clear in the details pane of keepass?

Milestone: KeePass_2.x

Status: closed

Owner: nobody

Labels: TimeOtp-Secret-Base32 (1)

Priority: 5

Updated: 2026-02-04

Created: 2026-02-03

Creator: GilGri

Private: No

Other protected fields correctly show as masked *****

2 Attachments

cap079.png

cap080.png

Discussion

Paul - 2026-02-03

KeePass doesn't have a TOTP wizard so it's not surprising the field is not automatically hidden.

How was the entry created?

cheers, Paul

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

GilGri - 2026-02-03

Via the TOTP wizard... :)

cap081.png

cap082.png

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Paul - 2026-02-03

Sorry, you are correct. I had forgotten where it was hiding. It's also hiding in the Help pages.

I'd call it an oversight, not a bug. :)

cheers, Paul

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

GilGri - 2026-02-04

Rather a serious security concern with all those M$ crappy screen-scrapers AI bloatware and office shouldersurfing!

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Paul - 2026-02-04

Only if they manage to get your user/pass as well. If they have you have more to worry about than one TOTP secret.

cheers, Paul

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

GilGri - 2026-02-04

Agree... however, the point is:

Is this 'oversight' just me or it's a confirmed general inconsistency, whereas other fields masking works properly?

Is it going to be fixed, sooner or later?
Not sure if the Dev team is one man band Dominik who's supposed to make the call.
Thanks for the feedback, Paul.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Paul - 2026-02-04

I tested it on my reasonably standard test copy and the secret field value was automatically hidden.

Will do some more testing tomorrow.

cheers, Paul

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Dominik Reichl - 2026-02-04

status: open --> closed
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Dominik Reichl - 2026-02-04

The 'OTP Generator Settings' dialog does activate the protection of the 'TimeOtp-Secret-Base32' field, and such fields are hidden in the details view by default.

My guess is that you have configured KeePass to display a 'TimeOtp-Secret-Base32' column in the main entry list without asterisks (this causes 'TimeOtp-Secret-Base32' values to be displayed in the details view without asterisks, too). You can check it in 'View' → 'Configure Columns'.

Best regards,
Dominik

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- GilGri - 2026-02-04
  
  This is probably the reason...
  I need to know which entries in the list have TOTP/2FA.
  The column is there for this reason and width reduced to a bare minimum (obviously): few initial characters.
  If I set that column to display with asterisks, then all entries, even the ones with no TOTP/2FA show asterisks and I lose that kind of visibility.
  
  cap085.png
  
  If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Dominik Reichl - 2026-02-04

I'd suggest:

Activate asterisks for the 'TimeOtp-Secret-Base32' column (in 'View' → 'Configure Columns').

Activate the option 'Unhide empty data' (in 'Tools' → 'Options' → tab 'Advanced').

With this, you can see which entries have a 'TimeOtp-Secret-Base32' value, and the values are hidden by asterisks.

Best regards,
Dominik
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- GilGri - 2026-02-04
  
  You the man, brother!
  
  If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Log in to post a comment.