TrayAuth 1.1.0

Three features, all about friction.

Codes in the desktop right-click menu

Right-click the desktop → TrayAuth codes → click an account, and its code is on your
clipboard. On Windows 11 the entry lives in the classic menu — click Show more options, or
press Shift+F10 to go straight there. The labels show live codes; the click always copies a
code computed at that moment, so a label that aged while the menu was open can never give you a
stale copy. Turn it off any time with tray menu → Codes in desktop right-click menu.

Copy a code straight from the tray menu

Right-click the tray icon: every account is listed with its live code and the seconds it has
left, refreshing while the menu is open. Click one to copy it — no panel, no window, nothing to
dismiss. The code is recomputed at the moment you click, so you never copy one that just expired,
and the clipboard still clears itself 20 seconds later.

Import from Google Authenticator

Move your accounts over without retyping a single setup key. On the phone: Settings → Transfer
accounts → Export accounts, which shows a QR. Then either:

• screenshot it, get the image to this PC, and use tray menu → Import → From QR image…
  (several files at once is fine), or
• show the QR anywhere on this PC's screen and use Import → Scan screen for QR code.

TrayAuth reads Google's otpauth-migration payload directly — a transfer QR carrying many
accounts imports them all at once. Multi-QR transfers are understood: scan the batch together or
one after another, and if part of the set is missing it tells you which. Ordinary otpauth://
enrollment QRs (the kind a website shows) import too. Counter-based (HOTP) entries are skipped
with a note rather than imported wrong, and every import still previews and asks before touching
your vault.

Upgrading

Run the installer over the top — settings and vault are untouched — or, once the winget package
is live: winget upgrade KlowdfurrRad.TrayAuth.

126 tests (up from 89), including a full round-trip proving the QRs TrayAuth renders are the QRs
it can read back, and a sandboxed exercise of the desktop-menu registry writer.

SHA256 of the installer:
0513F5F1077A469886430633CD5E11592BA4CF472CDA16B0ED9133B55647D708

TrayAuth for Linux 0.1.0 (alpha)

Alpha. First Linux build, aimed at Ubuntu/GNOME. It shares its entire tested core with the
Windows app - same RFC-verified code generation, same vault document, same export files - so
accounts move between the two by export -> import, and codes match digit-for-digit.

Install

tar xzf TrayAuth-Linux-0.1.0-alpha-linux-x64.tar.gz
cd TrayAuth-Linux-0.1.0-alpha
bash install.sh

Per-user, self-contained (no .NET needed). No sudo - with sudo it would install into
root's home instead of yours, so the script refuses to run as root. Then, before anything else:

~/.local/bin/trayauth --selftest

It proves the vault crypto, file permissions, RFC 6238 vectors and the export/import round trip
on your machine and must end with SELFTEST OK. Then ~/.local/bin/trayauth &.

Recommended packages:

sudo apt install wl-clipboard libsecret-tools

wl-clipboard makes tray-menu copying work on Wayland; libsecret-tools keeps the vault key in
the GNOME keyring rather than a 0600 file.

What works

• Tray icon (Ubuntu's AppIndicator extension is on by default); the menu lists every account
  with its live code - click to copy, clipboard clears after 20 s
• Codes panel with countdown rings; add/edit with live code preview
• Import from TrayAuth export files and from QR images (Google Authenticator transfer QRs
  included, multi-batch understood); export all with scannable QR PNGs
• Start on login toggle

Honest alpha limitations

• The panel opens centered - Wayland does not let apps position windows, so there is no
  slide-out and no anchoring to the tray icon, by platform design
• No global hotkey yet (GlobalShortcuts portal - planned)
• QR import reads image files only (screen scanning needs the Screenshot portal - planned)
• This build is the first to run on real GNOME hardware; report anything odd

SHA256:
A2E49B8E00ADF0A18E76EA3E490632497EE69CE45C7F1542777BD47FA0B8F468

TrayAuth for macOS and Linux 0.2.0 (alpha)

Alpha. First macOS build, plus a refreshed Linux build. Both come from one Avalonia app
(TrayAuth.Desktop) sharing its entire tested core with the Windows release - same RFC-verified
code generation, same vault document, same export files. Accounts move between all three
platforms by export then import, and the codes match digit-for-digit.

macOS

Pick your chip - arm64 for Apple Silicon (M1 and later), x64 for Intel:

tar xzf TrayAuth-macOS-0.2.0-alpha-arm64.tar.gz
cd TrayAuth-macOS-0.2.0-alpha-arm64
sh install.sh

~/Applications/TrayAuth.app/Contents/MacOS/trayauth --selftest   # must print SELFTEST OK
open ~/Applications/TrayAuth.app

Look for the keyhole icon in the menu bar. There is no Dock icon - it is a menu bar app
(LSUIElement), the counterpart of the Windows build having no taskbar button.

The vault key goes into the macOS Keychain; the clipboard uses pbcopy; start-on-login
installs a launchd LaunchAgent. Nothing else to install - the .NET runtime is inside the bundle.

Gatekeeper: the app is not signed or notarized (that needs a paid Apple Developer account),
so install.sh clears the download quarantine flag for you - the same thing right-click → Open
does. If you ever see "the developer cannot be verified", either right-click → Open, or run
xattr -dr com.apple.quarantine ~/Applications/TrayAuth.app.

Linux

Unchanged in behaviour; rebuilt from the shared project.

tar xzf TrayAuth-Linux-0.2.0-alpha-linux-x64.tar.gz
cd TrayAuth-Linux-0.2.0-alpha
bash install.sh                     # per-user, no sudo
~/.local/bin/trayauth --selftest
~/.local/bin/trayauth &

What was verified, and what was not

Verified here: 126 tests green (103 portable, 23 Windows-only), the selftest passing through
the shared code path, and 28 structural checks per macOS tarball - bundle layout, Info.plist
parsed and asserted key by key, Mach-O magic and CPU type matching the advertised architecture,
LF endings and shebangs on the scripts, the .icns chunk walk, and the bundled runtime.

Not verified: anything that needs a real Mac. The menu bar icon, Keychain access, clipboard
and LaunchAgent have never executed on macOS hardware. --selftest is the first thing to run and
the fastest way to tell me what broke.

Known alpha limitations

• No global hotkey yet on either platform.
• QR import reads image files only (no screen scanning).
• On Linux the panel opens centered - Wayland does not let apps position their own windows.
• The macOS menu bar icon is the colour icon, not a monochrome template image, so it will not
  adapt to light/dark menu bars the way native icons do.

Checksums

TrayAuth-macOS-0.2.0-alpha-arm64.tar.gz      DE1CEBC3DFA58D7E6EE81E1A753D11BEDC26F45C8DB69B2E97BEE2F6DB7497AF
TrayAuth-macOS-0.2.0-alpha-x64.tar.gz        7C8783754F2971451FD572AC988995406E1212DC3BB89A5CC064F190CDE5ED7D
TrayAuth-Linux-0.2.0-alpha-linux-x64.tar.gz  7A26E9366E16DD2A964AF514A2C57525EA15A2B662671E5D142C6032835C4D74

TrayAuth 1.0.0

Authenticator codes in the Windows tray. Click the tray icon and a panel slides out of the taskbar with your live codes; click a code to copy it.

Install

Download TrayAuth-Setup-1.0.0.exe below and run it.

No administrator rights and no UAC prompt — it installs under your own user profile. The .NET runtime is bundled, so there is nothing else to install.

You get a Start Menu entry, an entry in Settings → Installed apps, and start-with-Windows, so the icon is always in the tray.

What it does

• Add accounts by typing the base32 setup key the site shows next to its QR code
• Click a code to copy it — the clipboard clears itself after 20 seconds, and only if it still holds that code
• Ctrl+Alt+A opens the panel from anywhere
• Countdown ring per account, amber in the final 5 seconds
• Supports 6/7/8 digits, custom periods, and SHA1/SHA256/SHA512

Your accounts

The vault lives in %APPDATA%\TrayAuth\vault.dat, encrypted with Windows DPAPI and locked to your user account. It is never sent anywhere — TrayAuth makes no network calls at all.

Back it up. A DPAPI vault is bound to the Windows profile that wrote it: reinstall Windows or lose the profile and it cannot be read again. Use Export all accounts… from the tray menu. You get one JSON plus a scannable QR PNG per account, and a combined file that restores everything.

Those export files are not encrypted — each contains a secret that generates that account's codes indefinitely. Treat them like the passwords themselves.

Verified

89 tests, including the published RFC 6238 test vectors for SHA1, SHA256 and SHA512 and the RFC 4226 HOTP vectors, so the codes agree with every other authenticator.

Notes

• Windows 10 1809 or later, 64-bit
• The installer is not code-signed, so SmartScreen may warn on first run — choose More info → Run anyway, or verify the SHA256 below
• Uninstalling leaves your accounts in place unless you say otherwise

SHA256 of the installer:
8B1CB1487258F0BD3D9E061A6D85B7A9659F9529D12888B6A31FA7EF36D7D83A