v2.0.0 XIV Authenticator - with extra security!

Version 2.0 is a major security and integration update for Windows XIV Authenticator.

The biggest change is the new TPM-backed encrypted vault, replacing the older DPAPI-only storage model used by the 1.0.x series.

What's new

New v2 security architecture

Authenticator secrets are now protected using:

• AES-256-GCM encrypted vault storage
• a randomly generated 256-bit vault key
• RSA-OAEP-SHA256 wrapping of the vault key
• a non-exportable Windows CNG key
• Microsoft Platform Crypto Provider / TPM-backed key protection
• Windows Hello as the application-level unlock gate

The plaintext TOTP secret is not stored in vault.json.

Windows Hello verification is required when unlocking the authenticator in a new process.

Safe migration from 1.0.x

Existing version 1 users are automatically migrated from the previous DPAPI-based storage format.

Migration is verified before the old authenticator file is deleted.

If migration cannot complete successfully, the legacy authenticator remains intact.

New CLI

2.0 introduces:

xiv-auth.exe

with the initial command:

xiv-auth code

This provides a simple integration path for launchers, provider DLLs, plugins, and other local tools.

On success, the CLI outputs only the current six-digit OTP to stdout and returns exit code 0.

Failures use stderr and non-zero exit codes.

XIVLauncher support

The existing XIVLauncher workflows remain available:

• Generate OTP
• Send to XIVLauncher
• Launch XIV and send a fresh OTP automatically

The underlying authenticator secret is never sent to XIVLauncher.

Only the current six-digit OTP is passed over the local loopback interface.

Installer changes

The public release now uses the standard installer package.

The installer includes:

WindowsXIVAuthenticator.exe
xiv-auth.exe

A SHA-256 checksum is provided for the installer.

System requirements

Windows XIV Authenticator 2.x requires:

• Windows 11 x64
• TPM 2.0 enabled and available
• Windows Hello configured for the current Windows account

Version 2 deliberately does not fall back to software-backed key storage.

If your system cannot provide a usable TPM 2.0, use the latest Windows XIV Authenticator 1.0.x legacy compatibility release instead.

The 1.0.x series uses the older Windows DPAPI-based storage model and does not provide the TPM-backed v2 vault.

Backup recommendation

Windows XIV Authenticator can be used alongside your existing phone authenticator.

Keeping the same TOTP registration on your phone provides an independent backup if the PC, Windows installation, or TPM-backed vault becomes unavailable.

Documentation

The project documentation has been updated for 2.0, including:

• setup and migration guidance
• CLI integration documentation
• detailed security architecture
• supported-system requirements
• updated source-available licence

Release files

Download:

WindowsXIVAuthenticator-Setup-2.0.0.exe
SHA256SUMS.txt

Verify the installer with PowerShell:

Get-FileHash .\WindowsXIVAuthenticator-Setup-2.0.0.exe -Algorithm SHA256

and compare the result with SHA256SUMS.txt.

Notes

Windows XIV Authenticator remains local-first:

• no cloud account required
• no cloud OTP generation
• no telemetry
• no analytics
• no advertising
• no remote logging
• no remote secret storage

For the full security model and threat limitations, see docs/SECURITY.md.

Full Changelog: v1.0.0...v2.0.0