protected OneTimeTokenAccount decode(final OneTimeTokenAccount account) {
        val decodedSecret = toTokenCredentialCipherExecutor(account).decode(account.getSecretKey()).toString();
        val scratchCodesCipherExecutor = toScratchCodesCipherExecutor(account);
        val decodedScratchCodes = account.getScratchCodes()
            .stream()
            .map(code -> FunctionUtils.doAndHandle(() -> scratchCodesCipherExecutor.decode(code), t -> code).get())
            .collect(Collectors.toList());
        val newAccount = account.clone();
        newAccount.setSecretKey(decodedSecret);
        newAccount.setScratchCodes(decodedScratchCodes);
        return newAccount;
    }
Decode.

@param account the account
@return the one time token account
support/cas-server-support-otp-mfa-core/src/main/java/org/apereo/cas/otp/repository/credentials/BaseOneTimeTokenCredentialRepository.java