Expected Behavior

For entries with TOTP secrets having spaces, they work just fine as before. For example, "jzls hdx6 fvhm yzpu c6o3 rybg 4ytt uuap" can be successfully decoded and give a 6-digit number.

(This is just a fake example. I didn't actually use this secret on any website.)

Current Behavior

The string "Invalid TOTP secret key" is copied to the clipboard after hitting Ctrl+T. If "Show TOTP" is selected, it says "Invalid TOT secret key" (a typo? :)

Possible Solution

I suggest to ignore specific characters like Google's implementation: 522e132#diff-18f0d04bfa499ef56a17c0ba1d834e78L34. I have at least 10 entries with TOTP settings, and I don't think it's a good idea to ask users to fix them one by one.

A minor point - don't place the error message to the clipboard. Show a popup instead!

Steps to Reproduce (for bugs)

1. Create an entry
2. Setup TOTP and enter a secret like "jzls hdx6 fvhm yzpu c6o3 rybg 4ytt uuap"
3. Ctrl+T to copy the TOTP code or select "Show TOTP"

Context

Quite a few websites are broken as they provide base32-encoded secrets with spaces on the webpage, like Google or BitBucket. I believe there are more such sites.

Debug Info

KeePassXC - Version 2.2.1
Revision: 14e3d9d

Libraries:

• Qt 5.9.1
• libgcrypt 1.8.1

Operating system: Arch Linux
CPU architecture: x86_64
Kernel: linux 4.13.4-1-ARCH

Enabled extensions:

• KeePassHTTP
• Auto-Type
• YubiKey

I built keepassxc from the AUR building script with my own patch proposed at #1017 (comment)