What is it and why it was built

desktop‑2fa is an offline TOTP authenticator for people who want their second factor to live in a local encrypted vault. There is no cloud sync or account-based service.

It is CLI-first and includes an early Textual terminal UI prototype. The project uses password-based vault encryption, configurable vault paths, and commands for managing TOTP entries.

It does not replace hardware tokens or protect a compromised device. Review the security model to understand its limits.

From the 0.10.0 release tests

See Desktop-2FA in action

Real command output with synthetic accounts and credentials. Terminal frames are rendered from captured output; Textual is captured using its headless driver.

Add an account privately
The dedicated Secret prompt hides your input. Account name and issuer remain visible.

Your vault, your accounts
Create a vault and list accounts with one-based indices for duplicate recovery.

Codes for people and scripts
Human-readable, raw and JSON output from the same offline authenticator.

Predictable account management
Rename entries with explicit collision refusal to preserve existing accounts.

Encrypted backup and recovery
Export refuses an existing destination; recovery imports into a separate vault.

An early terminal interface
The Textual prototype lists accounts and generates or copies codes. Manage entries with the CLI.

Select an image to view it full size. Clipboard checks used a stub; these captures do not demonstrate the system clipboard or native UI behavior on every OS.

Capture method and limitations · Test campaign report (JSON)

Next on the wrist · Wear OS

D2FA Watch In development

An offline authenticator for Wear OS. The current MVP lets you create a vault, add accounts manually and generate TOTP codes directly on your watch.

We're working towards managing accounts on your computer and securely transferring selected ones to the watch, without cloud sync. That transfer workflow is still being designed.

Desktop-2FA remains free and open source. The Watch app is planned as a separate paid app.

The Watch app is in development; there is no download available here yet.

Install

Requires Python 3.11 or newer. Install from PyPI:

python -m pip install desktop-2fa

Or install the command-line app with pipx:

pipx install desktop-2fa

Basic usage (interactive add hides input at the dedicated Secret prompt):

# Create a vault and add a TOTP entry
d2fa vault init
d2fa add

# Generate a code
d2fa code GitHub

# List all entries
d2fa list

Installation guide · CLI reference

Features

Offline, Local-First

TOTP secrets live in your local encrypted vault; there is no cloud sync.

Encrypted Vault

AES-256-GCM authenticated encryption with Argon2id password-based key derivation.

TOTP Standards

Generate RFC 6238 codes; URI-based add preserves the algorithm, digit count and time period.

CLI and Terminal UI

A full command-line interface plus an early Textual UI prototype for viewing and copying codes.

Clipboard Options

Copy generated codes with the CLI's --copy or --copy-only options.

Configurable Vault

Choose a vault with --vault or DESKTOP_2FA_VAULT; zxcvbn evaluates password strength.

How it works

1. Choose or create a vault

Use the default local vault or select another path with --vault or DESKTOP_2FA_VAULT.

2. Add TOTP entries

Use d2fa add and enter a plain issuer name followed by the hidden secret. Provisioning URIs are also supported, preserving algorithm, digits and period.

3. Generate and copy codes

Run d2fa code <name>; use --copy or --copy-only to copy the code.

4. Back up your vault

Create an encrypted backup with d2fa backup and store it somewhere safe. Backups are not automatic.

Security model

AES-256-GCM authenticated encryption protects vault contents.
Argon2id derives encryption keys from passwords (time cost 4, memory cost 128 MiB, parallelism 2).
zxcvbn evaluates passwords; weak-password warnings or rejection can be configured.
Vault contents require password authentication; there are no session-based unlocks.
Vault files and backups remain local; there is no cloud sync or password recovery.

Desktop-2FA does not protect secrets on a compromised device or while they are in use. See the security model and threat limits.

CLI examples

# Add an entry using the hidden Secret prompt
d2fa add

# Generate a code
d2fa code GitHub --copy

# List entries with indices
d2fa list --indices

# Output for scripts
d2fa code GitHub --json
d2fa code GitHub --raw

# Create an encrypted backup
d2fa backup

See the CLI reference for vault options and other commands.

Who is it for?

Developers who prefer CLI workflows
Sysadmins managing secure workstations and VMs
Privacy-focused users avoiding cloud sync
People working on air-gapped machines
Anyone who wants 2FA without a phone

Is desktop-2fa right for you?

Choice	What it means
Local vault, no cloud sync	You manage backups and transfers; there is no account-based synchronization.
CLI-first	The complete feature set is exposed through command-line commands; the Textual UI is an early prototype.
Python package	Install with pip or pipx; Python 3.11 or newer is required.
Password recovery	There is no password reset. Users are responsible for keeping a recoverable, securely stored backup.

This describes desktop-2fa's documented design and trade-offs, not a ranking against other authenticators.

FAQ

Does desktop-2fa sync across devices?: No. Vaults are stored locally. You can create an encrypted backup and transfer it yourself.
Can I recover a forgotten vault password?: No. Keep a secure backup and password; there is no recovery key or reset service.
Does it have a user interface?: It has a full CLI and an early Textual terminal UI prototype (d2fa ui). The prototype can list entries, generate codes, and copy codes, but does not manage entries or create a missing vault.
Can I add a token from an otpauth URL?: Yes. The CLI accepts otpauth:// URLs with d2fa add. QR scanning is not listed as a current feature.
Which Python versions are supported?: Python 3.11 or newer. Once installed, the app works with its local vault and does not need cloud services.
Where is the vault stored?: By default at ~/.desktop-2fa/vault. Choose another file with --vault or set DESKTOP_2FA_VAULT.
What is D2FA Watch?: A Wear OS app in development. Its current MVP supports vault creation, manual account entry and offline TOTP on the watch. Computer-to-watch transfer is still being designed. Desktop-2FA remains free and open source; Watch is planned as a separate paid app.

Current project status

Desktop-2FA 0.10.0 was released on October 30, 2026. It remains free and open source under Apache 2.0. The CLI is the primary interface; Textual is an early terminal UI prototype.

Hidden secret input in interactive add, validated Base32 secrets and preservation of URI algorithm, digits and period
Exact account names take priority over unique issuer matches; ambiguous selections are refused
Encrypted export refuses overwrites by default; stale concurrent vault updates report a conflict
Consistent CLI exit statuses, JSON output for scripts and more accurate Textual code validity
D2FA v1 vault format and cryptographic parameters are unchanged; review upgrade and compatibility notes

See the full changelog and source repository. Work has also started on D2FA Watch for Wear OS.