Join 5,000+ subscribers getting weekly tips on web development, mobile apps, and AI solutions.
A local-only TOTP + HOTP two-factor authenticator for Android. No cloud account, no telemetry, no network permission at all — every code is generated entirely on your device, and your secrets never leave it except in a backup file you create yourself.
WHY WE BUILT IT
Most authenticator apps ask for more than they need, push you toward a cloud account, or bury the option to leave with your own data. We wanted one that does the opposite: everything stays on your device, the export format is the same open otpauth:// standard every other authenticator already understands, and there's nothing to sign up for.
WHAT IT DOES
RFC 6238 time-based codes for modern services, and RFC 4226 counter-based codes for the older hardware-token vendors that still issue them. Most authenticators only do the first.
Every account secret is encrypted with AES-256-GCM using a key generated inside Android Keystore, StrongBox-backed where the device supports it. The key itself never exists outside secure hardware.
Fingerprint or device PIN/pattern (BIOMETRIC_STRONG only) is required to open the app, reveal or copy a code, export a backup, or add/delete an account.
The app manifest declares no INTERNET permission at all — not "we promise not to use it," but structurally incapable of making a network call. No analytics, no crash reporter, no ad SDK.
Exports standard otpauth:// QR codes any authenticator can read, and imports Google Authenticator "Export accounts" QR codes directly — including multi-page exports for large account lists.
One password-protected file, written wherever you choose via the system file picker. No account, no server round-trip, no vendor lock-in.
FLAG_SECURE blocks screenshots, screen recording, and the recent-apps thumbnail from ever showing a live code. Copied codes auto-clear from the clipboard after 30 seconds.
A local Room database holds only ciphertext. The decoded secret is never written to disk, and is held in memory only for the instant a code is computed before being zeroed.
HOW CODES ARE GENERATED
Both algorithms are implemented against their RFC test vectors, not approximated — every code the app produces is verified to match the official specification exactly.
T = floor((now − T0) / period), then the same HMAC truncation HOTP uses, with T as the counter. Used by the vast majority of modern services — GitHub, Google, AWS, and most others.
A counter increments each time a code is generated. Because there's no time anchor, the counter can drift from the server (e.g. a hardware token button pressed without generating in-app) — a manual resync tries the next 10 counter values until one matches.
SECURITY DESIGN
This app's entire value is the secrets it holds — if they leak, every 2FA-protected account behind them is one step from compromise. Every decision below optimizes for secret confidentiality at rest and in memory, over convenience.
A secret is never written to disk, log, or backup in plaintext — no exceptions, including debug builds.
Copied codes are wiped from the clipboard after 30 seconds, closing a known cross-app leak vector.
A rooted device shows a clear warning that Keystore guarantees may not hold — it never hard-blocks the app.
YOUR DATA, PORTABLE
Scan a standard otpauth:// QR code, or Google Authenticator's multi-account "Export accounts" QR — including exports spanning several QR pages, which the app scans through automatically and merges before you review and choose what to import.
Export any account back out as a standard QR code, or export your whole library as a single password-encrypted file you save wherever you choose. Nothing is ever transmitted anywhere to do either.
BUILT WITH
QUESTIONS
No. The app declares no network permission at all and generates every code entirely on-device. It cannot make a network call even if it wanted to.
Yes. HostSpica Authenticator reads Google Authenticator's "Export accounts" QR codes directly, including exports that span multiple QR pages, and lets you review and select which accounts to import before anything is saved.
The backup is unrecoverable by design. The password is never stored anywhere, and there is no backdoor — this is a deliberate trade-off in favor of confidentiality.
Yes, via HOTP (RFC 4226) support with a manual resync flow for the counter drift that legacy hardware tokens are prone to — most modern authenticator apps only support TOTP and drop this entirely.
HostSpica Authenticator is in final testing. Check back here or watch HostSpica Labs for the Play Store link once it's live.
Back to Labs