Lockbox

An offline TOTP/HOTP authenticator for iOS. No accounts, no sync, no network code — your secrets never leave the device.

Lockbox generates the same six- or eight-digit two-factor codes as Google Authenticator or Raivo OTP, but the app contains no networking layer at all: nothing is uploaded, nothing is synced, and there is no backend to compromise.

Features

• TOTP (RFC 6238) and HOTP (RFC 4226) with SHA-1, SHA-256, and SHA-512
• 6 or 8 digit codes, 30- or 60-second periods
• Add accounts by scanning a QR code (otpauth:// URI) or entering a Base32 secret manually
• Face ID / Touch ID lock with device-passcode fallback; accounts are cleared from memory when the app is backgrounded and re-prompted on return
• Pinned and recently used sections, plus search
• Tap a code to copy — the clipboard entry is marked local-only and expires after 30 seconds
• Import and export in Raivo OTP's JSON format

Requirements

• iOS 17.0+
• Xcode 16
• Swift 6 (built with strict concurrency checking set to complete)
• XcodeGen

Building

Lockbox.xcodeproj is generated from project.yml and is deliberately not checked in, so a fresh clone will not open in Xcode until you generate it:

brew install xcodegen
xcodegen generate
open Lockbox.xcodeproj

Simulator builds require no signing setup. For a device build, select your team under Signing & Capabilities, or pass it on the command line:

xcodebuild -scheme Lockbox -destination 'generic/platform=iOS' DEVELOPMENT_TEAM=YOURTEAMID

Testing

The fastest path runs the suite on macOS through the Swift Package manifest, with no simulator needed:

swift test

To run the same tests in the simulator:

xcodegen generate
xcodebuild -scheme Lockbox -destination 'platform=iOS Simulator,name=iPhone 17 Pro' test

The suite covers the RFC 6238 and RFC 4226 reference vectors, otpauth:// URI parsing, and Raivo import/export round-tripping.

Security

Lockbox stores 2FA secrets, so please read SECURITY.md before trusting it with anything important. It documents the storage design, the known limitations, and how to report a vulnerability. This app has not been independently security audited.

Third-party code

All dependencies are consumed through Swift Package Manager; none are vendored into this repository.

Package	License
SwiftOTP	MIT © 2018 Lachlan Bell
swift-crypto	Apache-2.0
swift-asn1	Apache-2.0

License

MIT © 2026 Jeff Mueller