Skip to content

Home

Jump to bottom
Lukasz Perek edited this page Jan 4, 2026 · 2 revisions

desktop-2fa — Offline, Encrypted 2FA for Your Desktop

desktop-2fa is a fully offline, encrypted TOTP authenticator designed for secure workstations, VMs, servers, and air‑gapped environments. It stores your 2FA secrets in a local, AES‑GCM encrypted vault (with Argon2 key derivation) and generates RFC‑compliant TOTP codes directly from the command line. No cloud. No phone. No telemetry. Just verifiable, local security.

🚀 Key features

  • Encrypted vault:
    AES‑GCM encryption with Argon2‑based key derivation for protecting all stored TOTP secrets.

  • Offline‑only by design:
    No network access is required or used. Secrets never leave your machine.

  • Standards‑based TOTP:
    RFC‑compliant TOTP support (SHA1 / SHA256 / SHA512), compatible with common 2FA setups.

  • CLI‑first interface:
    Simple commands like
    desktop-2fa add, desktop-2fa list, desktop-2fa code <account>, desktop-2fa backup
    for everyday use and automation.

  • Deterministic, isolated tests:
    High test coverage and reproducible test runs to keep behavior predictable across releases.

  • Cross‑platform:
    Runs on Linux, macOS, and Windows.

  • Zero external dependencies:
    No background services, no external databases, no analytics or telemetry.

🎯 Why desktop‑2fa?

Most authenticator apps optimize for convenience: mobile‑first, cloud backups, cross‑device sync, and account integration. That works well for everyday consumer use, but it also increases the attack surface and couples your 2FA to third‑party infrastructure.

desktop-2fa is built for a different threat model:

  • You control the machine.
    Your secrets live only on systems you administer (workstations, VMs, servers, air‑gapped hosts).

  • No accounts, no vendor lock‑in.
    There is no requirement to sign in, register, or trust a remote service. The vault is a local file under your control.

  • Deterministic behavior.
    The tool is designed to behave the same way across environments and versions, with transparent code and reproducible builds.

  • CLI and automation friendly.
    Instead of tying 2FA to a phone, desktop-2fa integrates naturally with terminal workflows, secure shells, and scripted operations.

If you need an authenticator that respects strict environments and minimizes external dependencies, desktop-2fa gives you offline, auditable 2FA codes without introducing new online risks.

📦 Next steps

  • Installation: see the Installation page for platform‑specific setup instructions.
  • Usage: learn how to add, list, and generate codes in Usage.
  • Security model: for a deeper look at the vault and threat model, check Security Model.
  • Vault internals: for implementation details, see Vault Architecture.

❤️ Support

desktop-2fa is an independent, open-source project maintained in spare time.
If you find it useful and want to support its development, you can do so here:

Your support helps keep the project maintained, secure, and fully open.

Clone this wiki locally