OpenFactor
Open source two factor codes. No account, no server, no tracking.
Beta, in testing. OpenFactor works and is being tried on real devices,
but it has not had an independent security audit. Do not trust it with an account you
cannot recover yet. The reviews and hardware experiments so far are in the repository.
What it is
OpenFactor generates two factor authentication codes on iPhone and Apple Watch. There is no account to create, no server to trust, and no analytics. Your accounts stay on your devices, encrypted before they are stored. If you turn on iCloud sync, encrypted records travel through iCloud Keychain and the key that decrypts them stays on your devices.
What it does
- Codes on your wrist Shows one code at a time on Apple Watch, and keeps working with your iPhone off, absent, or out of range.
- Bring your accounts with you Imports from other authenticators, including Google Authenticator transfer codes and Aegis vaults, and reads a setup code from the Camera app or a screenshot.
- Backups you can take elsewhere Exports an encrypted backup whose format is public and documented, or a plain file for moving to another app. The difference is stated on screen.
- Locked to you An optional lock behind Face ID, Touch ID, or your passcode.
What it deliberately does not do
- No Mac app and no browser extension A second factor is worth less the moment it lives on the machine asking for it.
- No passwords and no autofill This is an authenticator, not a password manager.
- No accounts, no telemetry, no crash reporting The app makes no network requests of its own.
Built in the open
The source is public from the first commit, including the design documents, the security reviews, and the hardware experiments behind them, with the findings published whether or not they were flattering. Read it on GitHub.