v2.0.0 XIV Authenticator - with extra security!

Version 2.0 is a major security and integration update for Windows XIV Authenticator.

The biggest change is the new TPM-backed encrypted vault, replacing the older DPAPI-only storage model used by the 1.0.x series.

What's new

New v2 security architecture

Authenticator secrets are now protected using:

• AES-256-GCM encrypted vault storage
• a randomly generated 256-bit vault key
• RSA-OAEP-SHA256 wrapping of the vault key
• a non-exportable Windows CNG key
• Microsoft Platform Crypto Provider / TPM-backed key protection
• Windows Hello as the application-level unlock gate

The plaintext TOTP secret is not stored in vault.json.

Windows Hello verification is required when unlocking the authenticator in a new process.

Safe migration from 1.0.x

Existing version 1 users are automatically migrated from the previous DPAPI-based storage format.

Migration is verified before the old authenticator file is deleted.

If migration cannot complete successfully, the legacy authenticator remains intact.

New CLI

2.0 introduces:

xiv-auth.exe

with the initial command:

xiv-auth code

This provides a simple integration path for launchers, provider DLLs, plugins, and other local tools.

On success, the CLI outputs only the current six-digit OTP to stdout and returns exit code 0.

Failures use stderr and non-zero exit codes.

XIVLauncher support

The existing XIVLauncher workflows remain available:

• Generate OTP
• Send to XIVLauncher
• Launch XIV and send a fresh OTP automatically

The underlying authenticator secret is never sent to XIVLauncher.

Only the current six-digit OTP is passed over the local loopback interface.

Installer changes

The public release now uses the standard installer package.

The installer includes:

WindowsXIVAuthenticator.exe
xiv-auth.exe

A SHA-256 checksum is provided for the installer.

System requirements

Windows XIV Authenticator 2.x requires:

• Windows 11 x64
• TPM 2.0 enabled and available
• Windows Hello configured for the current Windows account

Version 2 deliberately does not fall back to software-backed key storage.

If your system cannot provide a usable TPM 2.0, use the latest Windows XIV Authenticator 1.0.x legacy compatibility release instead.

The 1.0.x series uses the older Windows DPAPI-based storage model and does not provide the TPM-backed v2 vault.

Backup recommendation

Windows XIV Authenticator can be used alongside your existing phone authenticator.

Keeping the same TOTP registration on your phone provides an independent backup if the PC, Windows installation, or TPM-backed vault becomes unavailable.

Documentation

The project documentation has been updated for 2.0, including:

• setup and migration guidance
• CLI integration documentation
• detailed security architecture
• supported-system requirements
• updated source-available licence

Release files

Download:

WindowsXIVAuthenticator-Setup-2.0.0.exe
SHA256SUMS.txt

Verify the installer with PowerShell:

Get-FileHash .\WindowsXIVAuthenticator-Setup-2.0.0.exe -Algorithm SHA256

and compare the result with SHA256SUMS.txt.

Notes

Windows XIV Authenticator remains local-first:

• no cloud account required
• no cloud OTP generation
• no telemetry
• no analytics
• no advertising
• no remote logging
• no remote secret storage

For the full security model and threat limitations, see docs/SECURITY.md.

Full Changelog: v1.0.0...v2.0.0

Windows XIV Authenticator v1.0.0

Windows XIV Authenticator v1.0.0

Windows XIV Authenticator has reached v1.0.0.

A lightweight native Windows authenticator built specifically to make logging into Final Fantasy XIV through XIVLauncher a little easier.

What's included

• Generate 6-digit TOTP authentication codes
• Send OTP codes directly to XIVLauncher
• Launch XIVLauncher and automatically send a fresh OTP once its listener is ready
• Import standard authenticator QR codes
• Import Google Authenticator exports
• Import QR codes from image files
• Import QR codes directly from the Windows clipboard
  • Works nicely with Win + Shift + S
• Secure local storage using Windows DPAPI
• Optional Windows Hello verification before revealing or sending OTP codes
• Configurable XIVLauncher location
• Built-in update checking for new stable releases
• Links to XIV Mods and JoeSparkx Software
• Optional Ko-fi support link

XIVLauncher setup

In XIVLauncher, enable:

Enable XL Authenticator app/OTP macro support

Restart XIVLauncher after enabling it.

Windows XIV Authenticator communicates with XIVLauncher locally through its OTP listener.

Windows Hello

Windows Hello can optionally be enabled from Settings.

When enabled, Windows XIV Authenticator requires successful Windows Hello verification before it decrypts and uses the saved authenticator secret.

This is intended as an additional local access/presence check on shared or unlocked PCs.

It is not intended to replace the stronger isolation provided by keeping your second authentication factor on a separate device.

Security

Authenticator secrets are stored locally and encrypted using Windows DPAPI for the current Windows user.

• No cloud storage
• No telemetry
• No remote logging
• No account credentials are sent to JoeSparkx Software
• OTP communication with XIVLauncher occurs locally on your PC

Downloads

Installer

Download:

WindowsXIVAuthenticator-Setup-1.0.0.exe

Recommended for most users.

Portable

Download the portable ZIP if you prefer to run the application without installing it.

SHA-256 hashes are included in:

SHA256SUMS.txt

Updating

From v1.0.0 onward, Windows XIV Authenticator checks GitHub for the latest stable release when the application starts.

If a newer version is available, you will be offered a link to the GitHub Releases page.

The application does not automatically download or install updates.

Disclaimer

Windows XIV Authenticator is an unofficial community tool.

It is not affiliated with, endorsed by, or supported by Square Enix, FINAL FANTASY XIV, XIVLauncher, or their respective developers.

Use is at your own discretion.

---

Built by JoeSparkx Software

https://github.com/JoeSparkx-Software/WindowsXIV-Authenticator

https://xivmods.com/

https://ko-fi.com/joesparkx

Full Changelog: v0.1.1...v1.0.0

v0.1.1 – Windows Hello Integration

v0.1.1 – Windows Hello Integration

Added

• Optional Windows Hello protection
• Require PIN, fingerprint or facial recognition before revealing or sending an OTP
• Windows Hello preference is saved between sessions
• Added XIV Mods link to the app

Improved

• OTP remains locked if Windows Hello verification is cancelled
• OTP is now generated only when XIVLauncher is ready to receive it, reducing the chance of sending a code close to expiry
• Minor UI/settings cleanup

Security

• TOTP secrets remain protected locally using Windows DPAPI
• Windows Hello adds an additional local verification step when enabled
• No cloud storage, telemetry or external OTP transmission

Notes

Windows Hello is optional. If disabled, the app behaves as before.

As always, this is an unofficial community tool and is not affiliated with Square Enix or XIVLauncher.

Full Changelog: v0.1.0...v0.1.1

v0.1.0 – Initial Public Release

Windows XIV Authenticator v0.1.0

Initial public beta release.

Features

• Local 6-digit TOTP generation
• QR image import
• Google Authenticator export import
• Windows DPAPI encrypted secret storage
• 30-second OTP refresh and countdown
• Direct OTP handoff to XIVLauncher
• One-click Launch XIV mode
• Configurable XIVLauncher path
• Self-contained Windows x64 installer
• Portable build
• SHA-256 checksums for release assets

Installation

Download:

WindowsXIVAuthenticator-Setup-0.1.0.exe

For additional integrity verification, compare the installer SHA-256 hash against SHA256SUMS.txt.

Notes

This is the initial public beta release. Please report problems through the GitHub repository.

Windows XIV Authenticator is an unofficial community tool and is not affiliated with Square Enix, Final Fantasy XIV, XIVLauncher, or Goatcorp.