TOTP Authenticator

TOTP Authenticator generates the six-digit codes that websites ask for as a second step after your password, following the TOTP standard (RFC 6238).

It works entirely offline. The app holds no internet permission, so it cannot send anything anywhere. There is no account to create, nothing to sign in to, and no sync. Everything it knows lives in a single file on your phone.

WHAT IT DOES

• Generates six-digit codes for any service that supports authenticator apps

• Add a code by scanning the setup QR code, or by typing the secret key by hand

• Organise codes into groups — personal, work, whatever suits you

• Tap a code to copy it; a ring counts down the seconds before it changes

• Copied codes are marked sensitive, so on Android 13 and later they stay out of the clipboard preview and clipboard history

HOW YOUR KEYS ARE STORED

Your secret keys live in one file on your phone, encrypted with AES-256. The key is derived from your password or PIN with PBKDF2 and a random salt kept alongside the data. Nothing is tied to a particular handset, so the file opens on any phone that has this app and the secret.

You choose the lock when you first set up, and you can change it later:

• Password — the strongest choice

• PIN — four or six digits. A PIN is far easier to guess, so the app spends much longer deriving the key from one, which makes guessing against a stolen file correspondingly slower

• No lock — the keys are stored in plain text. The app warns you clearly before allowing it

Changing the lock copies the database aside, re-encrypts it, then reads it back and checks it before removing the copy, so a change that goes wrong costs you nothing.

BACKUP AND MOVING TO A NEW PHONE

Send a copy of your database to yourself by email, cloud drive or a messaging app. On the new phone, install the app and import that file. It opens with the same password it had before, because the encryption travels with the file.

Keep a backup somewhere safe. If you lose your phone without one, you lose access to every account whose only second factor was in here.

THERE IS NO RECOVERY

Your password is not stored anywhere — it is what the encryption key is built from — and there is no server holding a reset link. A forgotten password means a database nobody can open, you included.

PERMISSIONS

• Camera, and only while you are scanning a QR code. Nothing is recorded.

That is the only permission the app asks for on current Android versions. There is no internet permission.

OPEN SOURCE

Built on ZXing, Jackson, Apache Commons Codec, AndroidX and Material Components, GoogleAuth and DirectoryPicker. The full licence notices are in the app, under About.