The authenticator your desktop was missing.
Authy and Google Authenticator don't run on your computer. 3FA does — and locks your one-time codes behind real hardware security.
Builds are being published — check back shortly.
Built for security, not bloat
Native & tiny
Built in Rust with a pure-native Slint UI — no Electron, no webview. ~10 MB install, low memory.
Multi-factor lock
Codes stay sealed behind a 6-digit passcode, Touch ID / Windows Hello, a hardware passkey, or your voice.
Auto-lock
Locks itself after 90 seconds idle. Staying open up to 5 minutes requires a second factor.
Zero-knowledge sync
Your vault is end-to-end encrypted before it leaves the device. Our servers only ever see ciphertext.
Standards-based
RFC 6238 TOTP and RFC 4226 HOTP — works with Google, GitHub, AWS, and any service you already use.
On-device biometrics
Voiceprint and fingerprint never leave your machine. No biometric data is uploaded, ever.
How the lock works
- Seeds are encrypted with XChaCha20-Poly1305 under a key derived from your passcode (Argon2id) and sealed to the Secure Enclave / TPM.
- Unlock with passcode, biometric, passkey, or voice — configure 2FA or 3FA per your threat model.
- Idle 90s → auto-lock. Need longer? Present a second, distinct factor for up to 5 minutes.
- Optional sync encrypts the whole vault end-to-end; the server stores an opaque blob it can never read.