AuthFree · no account · works offline
Two-factor codes that stay on your device
Auth keeps your one-time codes in an encrypted vault on your phone or computer. There is no account to create, no cloud to trust, and nothing that tracks you.
- AndroidGoogle Play · coming soon
- Windowscoming soon
- Linux.deb and AppImage · coming soon
Everything an authenticator should do. Nothing it shouldn't.
Made for people with dozens of accounts who want a code in two seconds, and want to know exactly where their secrets are.
-
Offline by design
No account and no servers. The Android app does not even ask for permission to use the internet, so you can check that in the store listing.
-
An encrypted vault
Secrets are sealed with XChaCha20-Poly1305 under a key derived from your master password with Argon2id. A recovery code covers a forgotten password.
-
Quick to open
Unlock with your fingerprint or the system keychain, or with a short PIN, and the vault locks itself again after a few idle minutes.
-
Quick Auth on the desktop
Press Ctrl Shift Space anywhere, type a few letters, press Enter, and the code is on your clipboard.
-
Move in, move out
Bring accounts from Google Authenticator, Aegis, 2FAS, Ente Auth, Bitwarden and andOTP. Take them with you any time as an encrypted backup.
-
Tidy at any size
Groups, favourites and one search across everything. Copied codes are wiped from the clipboard after 30 seconds.
Built so that a mistake can't leak your secrets
An authenticator holds the keys to everything else. These are the decisions that keep them where they belong.
- The interface never sees a secret.The vault lives in a Rust core. The screen you tap only ever receives account names and the codes of the moment, which expire in seconds.
- One implementation of the cryptography.Every platform runs the same open-source, widely reviewed Rust libraries. No second copy of the code in JavaScript, so there is no second copy to get wrong.
- Locked by default.The key is wiped from memory on lock and never written to disk unwrapped. Quick unlock keeps it in the system keystore, not in a file.
- Nothing to collect, nowhere to send it.We run no analytics, no crash reporter and no ads. Read the privacy policy: it is short because there is little to say.
Free, and staying that way
Everything above costs nothing, with no limit on accounts and no ads.
Later we plan to offer an optional, paid sync between your devices. It will be end-to-end encrypted, so we will hold only data we cannot read.
Your codes will never be behind a paywall. If a subscription lapses, syncing stops; the app and every code keep working.
Questions
Where are my codes stored?
In one encrypted file on your device, inside the app's private storage. Nothing is uploaded anywhere. If you export a backup, the file goes where you choose to put it.
What if I forget my master password?
Use the recovery code Auth showed you when you set it up. Keep it somewhere safe, offline.
Without the password or the recovery code, nobody can open the vault — not you, and not us. That is the point of encryption we can't bypass.
Does it work without an internet connection?
Yes, always. Codes are calculated from your device's clock, so Auth works on a plane, abroad, or with no SIM at all.
Can I move my accounts from Authy?
Not directly. Authy has no export: its seeds live encrypted on Twilio's servers, and the last way to read them out went away with the desktop apps in 2024. The reliable route is to open each service's security settings, turn two-factor off and on again, and scan the new code into Auth.
How do I move to a new phone?
Save an encrypted backup from Settings → Backup & import and restore it on the new device. You can also show any account's setup QR code and scan it across.
Do I need an account?
No. There is nothing to sign up for. The optional sync we plan to add later will need one; the app never will.