Steam Guard

Steam Guard

Steam Guard in TcNo Account Switcher stores Steam mobile authenticator secrets and Steam sign-in sessions in an encrypted folder on your PC. With it you can generate Steam Guard codes, approve trade and market confirmations, sign accounts in again without retyping a password, and read per-account data that Steam only shows to a signed-in session, such as CS2 cooldowns and ranks.

It is optional. The rest of the switcher works without it. See Platform Steam for ordinary account switching.

Where it is

Action	Where
Open the account picker	Shield button in the bottom bar on the Steam page
Open one account	Right-click a Steam account -> Steam Guard
Add an account	Right-click empty space on the Steam page -> New Account
Vault settings, backups, factors	Steam -> Settings -> Steam Guard

What happens to your Steam password

When you sign in through the Steam Guard window, the app asks Steam for that account's current RSA public key (IAuthenticationService/GetPasswordRSAPublicKey), encrypts your password with it, and sends the ciphertext to Steam to start the sign-in. The password is used for that one call. The working copy the app makes is zeroed as soon as the call returns; the original string handed over by the window cannot be zeroed in the same way and is released to the runtime. It is never written to a file, never put in the vault, and never logged.

What Steam hands back is a session: an access token and a refresh token. Those are what the app stores, inside the encrypted vault.

What the vault stores

One record per account. Its shape depends on how the account was added.

Record	Contents
Authenticator	Shared secret, identity secret, Steam's revocation code, device ID, and the account's session tokens
Login only	Session tokens and the Steam account name. No authenticator secrets
Unfinished setup	A half-finished enrollment, kept encrypted so it can resume

The record index is encrypted too, so the list of which SteamID64s are in the vault is not readable without unlocking. A separate plaintext file outside the vault does record which accounts have Steam Guard set up, so the account list can draw a lock icon while the vault is closed. See What stays readable while locked.

Login Only and full authenticator

Login Only signs in and keeps the session. Nothing changes on your Steam account: no authenticator is added, no codes are generated, and Steam Mobile keeps doing whatever it was doing. It exists so the app can ask Steam account-private questions, such as the CS2 competitive cooldown, Premier and Wingman standings, and which games the account owns.

Steam Guard moves the mobile authenticator itself into the vault. The account needs a phone number on it. Steam sends a confirmation code by email or SMS, then reveals a recovery code beginning with R. That code is Steam's, not the app's, it is shown once, and it is how you remove the authenticator later. Write it down.

Both start the same way. The add-account window offers Add account as: Login Only or Steam Guard; on an account the vault does not hold yet, the same choice appears as Just Login or Add Steam Guard.

A Login Only account can be promoted afterwards. Open it and choose Add Steam Guard; the stored session is reused, so Steam only asks for the email or SMS code. If Steam has stopped accepting the saved session, the app says so and asks for your Steam password instead.

Removal is asymmetric. A Login Only record can be removed from the vault at any time. An authenticator record cannot, because its shared secret exists nowhere else once Steam has issued it.

How the vault is protected

Argon2id derives a key from your Steam Guard password with 256 MiB of memory, 3 passes and 4 lanes, against a random per-factor salt. That key unwraps a random 32-byte vault key, which unwraps a per-record data key, which decrypts the record. Every layer is AES-256-GCM with the vault id, record id and SteamID64 bound in as authenticated data, so a record file moved between vaults will not open.

Writes are transactional. Each change builds a complete new generation folder, decrypts and verifies every record in it, and only then switches the active pointer and deletes the old generation. An interrupted write is rolled back the next time the vault is opened.

On Windows the vault folder and every file in it are given a protected DACL granting full access to your account and SYSTEM only.

Ways in

A vault can have several ways in. Any one of them opens it. Within one way in, everything it lists is required, so "password and keyfile" is one way in, not two.

Way in	Notes
Password	The one you set when creating the vault
Backup key	Printed as XXXXX-XXXXX-XXXXX-XXXXX-XXXXX-X. Shown once. Creating another replaces it
Keyfile	A file the app generates and you save (default name steam-guard-keyfile.txt). One per vault. Requires a backup key to already exist
Security key	FIDO2, through the Windows prompt. Enrol a spare

The backup key always stands alone. A keyfile or security key can be given a password of its own, chosen when you enrol it. That is a separate password used only with that factor, not the vault password. The app refuses to remove the last way in, and refuses to remove the backup key while a keyfile or security key is enrolled.

Manage these under Steam -> Settings -> Steam Guard -> Manage.

How long it stays unlocked

By default the key is held for five minutes from the moment you unlock, then dropped. Turning on Keep Steam Guard unlocked for this session holds it until you press Lock now, lock the app, or close the app.

The key lives in protected memory. If the system refuses that, the app falls back to unlocking for a single operation and stays locked afterwards, which is what the "protected session memory is unavailable" message means.

The second layer, when an app password is set

If Settings -> System -> Security -> Encrypt saved/cached account data is on, the vault gets an outer AES-GCM layer over the record files and the index, keyed from the app's own master key. Both the Steam Guard password and the app-derived key are then needed to read anything, and the app refuses to let the two passwords be the same.

Alongside it the vault stores a recovery wrapper: the outer key sealed under your app password, with its own Argon2id salt. That is what lets a copy of the folder be opened on another installation, where the local master key does not exist. The wrapper is rewritten when you change the app password.

The recovery wrapper only recovers the outer key. It is not a way past the Steam Guard password.

If you forget the Steam Guard password

There is no reset and no escrow. Nobody, including this project, holds a copy of the key.

What can still work:

1. Another enrolled way in. Unlock with the backup key, keyfile or security key, then Manage -> Add password to set a new one.
2. A backup folder made while you still knew the password. Restoring it gives you those accounts back under that password.

If neither exists, the encrypted records stay encrypted. Authenticator secrets in that vault are gone.

Your Steam accounts themselves are separate from the vault. Each one still has the R-prefixed recovery code Steam showed during setup, which is Steam's way to remove the authenticator. That is why the app makes you type it back before it finishes setup. Recovering a Steam account is Steam's process, not this app's; start at Steam Support.

Backup and restore

Create Verified Backup copies the whole Steam Guard folder to a location you choose, re-derives the copy's header at a deliberately higher cost (512 MiB, 4 passes), then reopens the copy and decrypts every record in it before reporting success. The date and path are recorded in Steam Guard settings.

A backup made with the outer layer keeps its recovery wrapper, so it opens on a clean installation with the Steam Guard password plus the app password in force when the backup was made.

Restore from backup behaves differently depending on what you already have:

• No vault on this installation: the backup becomes the vault.
• A vault already here: the backup is staged and compared, you pick which accounts to bring across, and a fresh verified backup of the current vault is written before anything is replaced.

Restore asks only for the passwords the chosen folder actually needs: the backup's Steam Guard password, the backup's app password if it carries an outer layer, and this installation's current app password if this installation encrypts saved account data.

Changing the Steam Guard password does not rewrite old backups. They still open with the password they were made under, so make a new backup after a password change.

maFile import and export

Import an SDA maFile from Import maFile, or drag one or more onto the switcher window. Encrypted SDA files are supported; the app asks for the SDA password and reads the salt and IV from the adjacent manifest.json.

Export writes the authenticator back out in SDA format, without the web session tokens. Setting an optional maFile password encrypts it the way SDA does and writes a matching manifest.json beside it. The exported file controls the authenticator, so store it the way you store the vault.

Session tokens over time

Each token carries its own expiry, which the app reads locally without contacting Steam. Steam sets both lifetimes, and in practice the access token runs out long before the refresh token does.

• Access token lapsed, refresh token still good: the app mints a new access token from the refresh token when you open the account. Nothing is asked of you.
• Both lapsed, or Steam rejects the refresh token: the account shows Login, and signing in with your Steam password replaces the session.

A token within two minutes of its expiry is treated as already expired, so the answer does not flip between the local check and the request that follows it.

Where the files are

{UserData} is your user data folder, %AppData%\TcNo Account Switcher by default. See Home.

Path	Contents
{UserData}\SteamGuard\active	Which generation is current
{UserData}\SteamGuard\generation-{id}\header.json	Ways in: salts, KDF parameters, and the wrapped vault key. No plaintext secret
{UserData}\SteamGuard\generation-{id}\keyring.bin	Encrypted record index
{UserData}\SteamGuard\generation-{id}\records\{id}.bin	One encrypted account record
{UserData}\SteamGuard\registrations.json	Plaintext: SteamID64 and state (active, pending, login_only)
{UserData}\Settings\SteamGuard.json	Feature toggle, session-unlock preference, last verified backup

Back up the whole SteamGuard folder, not individual files. A record is useless without the header and the keyring from the same generation.

What stays readable while locked

These files sit outside the vault on purpose, so the account list, the games view and the stats badges still render when the vault is closed. None of them holds a token, a secret or a password.

File	Contents
{UserData}\SteamGuard\registrations.json	SteamID64 and Steam Guard state
{UserData}\LoginCache\Steam\accounts.json	SteamID64, account and persona names, last-login timestamps copied from loginusers.vdf
{UserData}\LoginCache\Steam\CS2Cooldowns.json	SteamID64, cooldown expiry, when it was checked
{UserData}\LoginCache\Steam\CS2Ranks.json	SteamID64, Premier rating, Wingman rank, competitive rank, Prime state
{UserData}\LoginCache\Steam\OwnedGames.json	SteamID64 and owned app ids. No names

Treat these as you would LoginCache generally: they say which accounts you have, not how to use them.

Screen capture

Steam Guard windows are excluded from screen capture, so a code or a trade does not land in a recording, a screen share or a remote-desktop session. Run the app with --allow-steamguard-capture, or set TCNO_ALLOW_STEAMGUARD_CAPTURE=1, to lift it for that run; the log records that the protection is off. See Environment variables.

This is separate from Settings -> Privacy, where you can hide the rest of the app's windows from capture, and from streamer mode, which censors names and avatars on screen.

See also

• Platform Steam
• FAQ details
• Home