desktop‑2fa

desktop‑2fa is a secure, offline TOTP authenticator designed for desktop environments. It provides a fully local, encrypted vault for storing 2FA secrets, a clean and predictable CLI workflow, and a transparent architecture built around modern cryptographic standards. The project is aimed at users who value privacy, reproducibility, and complete control over their authentication data.

---

Why desktop‑2fa?

Most 2FA tools today rely on mobile devices, cloud sync, or proprietary storage. desktop‑2fa takes a different approach:

• offline‑only — no network access, no cloud, no telemetry
• desktop‑native — ideal for workstations, servers, and air‑gapped machines
• transparent and auditable — open code, clear architecture, reproducible behavior
• strong cryptography — AES‑256‑GCM for authenticated encryption, Argon2id for key derivation
• simple and scriptable — CLI‑first design integrates easily with existing workflows

desktop‑2fa is built for people who want a trustworthy, minimal, and secure way to manage TOTP codes without relying on external services.

---

Key Features

🔐 Encrypted Vault

All TOTP secrets are stored in a local vault encrypted with:

• AES‑256‑GCM for confidentiality and integrity
• Argon2id for password‑based key derivation
• unique salt and nonce per vault
• authenticated decryption with GCM tags

No plaintext secrets are ever written to disk.

🧭 Offline‑First Architecture

desktop‑2fa never connects to the internet.
There is:

• no cloud sync
• no telemetry
• no analytics
• no external dependencies

Your secrets stay on your machine — always.

🖥 CLI‑First Workflow

The command‑line interface provides:

• adding new TOTP entries
• listing stored accounts
• generating codes
• backing up and restoring vaults
• inspecting vault metadata

The CLI is designed to be predictable, scriptable, and easy to integrate into automation.

🧪 High Test Coverage

The project includes:

• deterministic tests
• isolated temporary vaults
• mocked cryptography for reproducibility
• full coverage of CLI commands

This ensures long‑term stability and confidence for contributors.

🧱 Modular Architecture

The codebase is structured into clear modules:

• vault management
• encryption
• TOTP generation
• CLI commands
• utilities

This makes the project easy to navigate and extend.

---

Target Audience

desktop‑2fa is ideal for:

• developers and sysadmins who prefer desktop tools
• users working on secure or air‑gapped systems
• privacy‑focused individuals who avoid cloud‑based authenticators
• people who want a transparent, auditable 2FA solution
• teams that need reproducible, scriptable authentication workflows

---

Roadmap

Planned features include:

• cross‑platform GUI
• QR code import (file, clipboard, webcam)
• HOTP support
• vault export to human‑readable format
• Rust backend for performance and security
• plugin system for custom workflows
• localization (PL/EN/DE)

The roadmap evolves based on community feedback and real‑world usage.

---

Security Model

desktop‑2fa follows a clear and documented security model:

• protects against unauthorized vault access
• protects against tampering and corruption
• does not protect against compromised host systems
• password is never stored
• brute‑force attempts are mitigated by Argon2id cost parameters

Every vault read operation verifies header, version, Argon2 parameters, and GCM tag integrity.

---

Philosophy

desktop‑2fa is built around three principles:

1. Local‑first — your data stays with you
2. Minimal and transparent — no unnecessary complexity
3. Reproducible and testable — predictable behavior across systems

The goal is not to replace mobile authenticators, but to provide a secure, desktop‑native alternative for people who need it.

---

Contributing

Contributions are welcome.
The project values:

• clean code
• reproducibility
• clear documentation
• security awareness
• respectful collaboration

The repository includes guidelines for development, testing, and architecture.

---

License

desktop‑2fa is source‑available under a custom license included in the repository.
It allows personal and non‑commercial use while protecting the project from unauthorized commercial exploitation.

---

Summary

desktop‑2fa is a modern, offline, encrypted TOTP authenticator for desktop systems.
It combines strong cryptography, a clean CLI, and a transparent architecture to give users full control over their 2FA secrets — without cloud services, telemetry, or hidden dependencies.

If you value privacy, reproducibility, and simplicity, desktop‑2fa is built for you.