diff --git a/internal/vaults/aegis/aegis_test.go b/internal/vaults/aegis/aegis_test.go
index 33047f5..2aec476 100644
--- a/internal/vaults/aegis/aegis_test.go
+++ b/internal/vaults/aegis/aegis_test.go
@@ -63,9 +63,9 @@ func TestEntries(t *testing.T) {
 				{Issuer: "iss-5"},
 			},
 			[]vaults.Entry{
-				{Issuer: "iss-1", Digits: 6, Secret: "secret", Type: "TOTP", Algorithm: "SHA1", Period: 30},
-				{Issuer: "iss-3", Digits: 6, Secret: "secret", Type: "TOTP", Algorithm: "SHA1", Period: 20},
-				{Issuer: "iss-4", Digits: 4, Secret: "secret", Type: "TOTP", Algorithm: "SHA256", Period: 30},
+				{Issuer: "iss-1", Digits: 6, Secret: "SECRET", Type: "TOTP", Algorithm: "SHA1", Period: 30},
+				{Issuer: "iss-3", Digits: 6, Secret: "SECRET", Type: "TOTP", Algorithm: "SHA1", Period: 20},
+				{Issuer: "iss-4", Digits: 4, Secret: "SECRET", Type: "TOTP", Algorithm: "SHA256", Period: 30},
 			},
 		},
 	}
diff --git a/internal/vaults/andotp/andotp_test.go b/internal/vaults/andotp/andotp_test.go
index dc840ac..040c24a 100644
--- a/internal/vaults/andotp/andotp_test.go
+++ b/internal/vaults/andotp/andotp_test.go
@@ -62,9 +62,9 @@ func TestEntries(t *testing.T) {
 				{Issuer: "iss-5"},
 			},
 			[]vaults.Entry{
-				{Issuer: "iss-1", Digits: 6, Secret: "secret", Type: "TOTP", Algorithm: "SHA1", Period: 30},
-				{Issuer: "iss-3", Digits: 6, Secret: "secret", Type: "TOTP", Algorithm: "SHA1", Period: 20},
-				{Issuer: "iss-4", Digits: 4, Secret: "secret", Type: "TOTP", Algorithm: "SHA256", Period: 30},
+				{Issuer: "iss-1", Digits: 6, Secret: "SECRET", Type: "TOTP", Algorithm: "SHA1", Period: 30},
+				{Issuer: "iss-3", Digits: 6, Secret: "SECRET", Type: "TOTP", Algorithm: "SHA1", Period: 20},
+				{Issuer: "iss-4", Digits: 4, Secret: "SECRET", Type: "TOTP", Algorithm: "SHA256", Period: 30},
 			},
 		},
 	}
diff --git a/internal/vaults/entry.go b/internal/vaults/entry.go
index e9b22ec..2424eaa 100644
--- a/internal/vaults/entry.go
+++ b/internal/vaults/entry.go
@@ -102,6 +102,9 @@ func (e *Entry) SanitizeAndValidate() error {
 		return ErrMissingSecret
 	}
 
+	e.Secret = strings.ToUpper(e.Secret)
+	e.Secret = strings.ReplaceAll(e.Secret, " ", "")
+
 	if strings.ToUpper(e.Type) != "TOTP" {
 		log.Printf("%q: ignoring: %s", e.Issuer, e.Type)
 		return ErrInvalidType
diff --git a/internal/vaults/entry_test.go b/internal/vaults/entry_test.go
index d90e288..2a74e6b 100644
--- a/internal/vaults/entry_test.go
+++ b/internal/vaults/entry_test.go
@@ -234,6 +234,24 @@ func TestEntry_SanitizeAndValidate(t *testing.T) {
 			},
 			false,
 		},
+		{
+			"normalizes: secret to uppercase",
+			&Entry{
+				Secret:    "abc123",
+				Type:      "TOTP",
+				Period:    30,
+				Algorithm: "SHA1",
+				Digits:    6,
+			},
+			&Entry{
+				Secret:    "ABC123",
+				Type:      "TOTP",
+				Period:    30,
+				Algorithm: "SHA1",
+				Digits:    6,
+			},
+			false,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/internal/vaults/keepass/keepass_test.go b/internal/vaults/keepass/keepass_test.go
index 0e4467a..ee0b064 100644
--- a/internal/vaults/keepass/keepass_test.go
+++ b/internal/vaults/keepass/keepass_test.go
@@ -83,9 +83,9 @@ func TestEntries(t *testing.T) {
 				}},
 			},
 			[]vaults.Entry{
-				{Issuer: "iss-1", Label: "demo1", Digits: 6, Secret: "secret", Type: "TOTP", Algorithm: "SHA1", Period: 30},
-				{Issuer: "iss-3", Label: "demo3", Digits: 6, Secret: "secret", Type: "TOTP", Algorithm: "SHA1", Period: 20},
-				{Issuer: "iss-4", Label: "demo4", Digits: 4, Secret: "secret", Type: "TOTP", Algorithm: "SHA256", Period: 30},
+				{Issuer: "iss-1", Label: "demo1", Digits: 6, Secret: "SECRET", Type: "TOTP", Algorithm: "SHA1", Period: 30},
+				{Issuer: "iss-3", Label: "demo3", Digits: 6, Secret: "SECRET", Type: "TOTP", Algorithm: "SHA1", Period: 20},
+				{Issuer: "iss-4", Label: "demo4", Digits: 4, Secret: "SECRET", Type: "TOTP", Algorithm: "SHA256", Period: 30},
 			},
 		},
 	}
diff --git a/internal/vaults/stratum/stratum_test.go b/internal/vaults/stratum/stratum_test.go
index 000974f..5895293 100644
--- a/internal/vaults/stratum/stratum_test.go
+++ b/internal/vaults/stratum/stratum_test.go
@@ -71,9 +71,9 @@ func TestEntries(t *testing.T) {
 				{Issuer: "iss-5"},
 			},
 			[]vaults.Entry{
-				{Issuer: "iss-1", Digits: 6, Secret: "secret", Type: "TOTP", Algorithm: "SHA1", Period: 30},
-				{Issuer: "iss-3", Digits: 6, Secret: "secret", Type: "TOTP", Algorithm: "SHA1", Period: 20},
-				{Issuer: "iss-4", Digits: 4, Secret: "secret", Type: "TOTP", Algorithm: "SHA256", Period: 30},
+				{Issuer: "iss-1", Digits: 6, Secret: "SECRET", Type: "TOTP", Algorithm: "SHA1", Period: 30},
+				{Issuer: "iss-3", Digits: 6, Secret: "SECRET", Type: "TOTP", Algorithm: "SHA1", Period: 20},
+				{Issuer: "iss-4", Digits: 4, Secret: "SECRET", Type: "TOTP", Algorithm: "SHA256", Period: 30},
 			},
 		},
 	}
diff --git a/internal/vaults/twofas/twofas_test.go b/internal/vaults/twofas/twofas_test.go
index 539c1bc..e39ea50 100644
--- a/internal/vaults/twofas/twofas_test.go
+++ b/internal/vaults/twofas/twofas_test.go
@@ -63,9 +63,9 @@ func TestEntries(t *testing.T) {
 				{Otp: otp{Issuer: "iss-5"}},
 			},
 			[]vaults.Entry{
-				{Issuer: "iss-1", Digits: 6, Secret: "secret", Type: "TOTP", Algorithm: "SHA1", Period: 30},
-				{Issuer: "iss-3", Digits: 6, Secret: "secret", Type: "TOTP", Algorithm: "SHA1", Period: 20},
-				{Issuer: "iss-4", Digits: 4, Secret: "secret", Type: "TOTP", Algorithm: "SHA256", Period: 30},
+				{Issuer: "iss-1", Digits: 6, Secret: "SECRET", Type: "TOTP", Algorithm: "SHA1", Period: 30},
+				{Issuer: "iss-3", Digits: 6, Secret: "SECRET", Type: "TOTP", Algorithm: "SHA1", Period: 20},
+				{Issuer: "iss-4", Digits: 4, Secret: "SECRET", Type: "TOTP", Algorithm: "SHA256", Period: 30},
 			},
 		},
 	}