Frequently Asked Questions

What is desktop-2fa?

An offline TOTP authenticator with a Python CLI and an early Textual terminal UI prototype. TOTP secrets are stored in a local encrypted vault.

Does it sync to the cloud?

No. Vaults stay local. Backups and transfers are user-managed.

Where is the vault stored?

The default is ~/.desktop-2fa/vault. Use --vault PATH or DESKTOP_2FA_VAULT to choose another path.

What interfaces are available?

The CLI is the primary interface. d2fa ui is an early prototype that can list entries, generate codes, and copy codes; it cannot manage entries or create a missing vault.

Can I recover my password?

No. There is no reset or recovery key. Store the password securely and create a separate encrypted backup.

How do I back up or move the vault?

Run d2fa backup for an encrypted backup, or use d2fa export and d2fa import to move a vault. Backups are not automatic.

Can I add an otpauth URL or scan a QR code?

The CLI accepts otpauth:// URLs with d2fa add. QR scanning is not listed as a current feature.

What is D2FA Watch?

A separate Wear OS app in development. The current MVP can create a vault, add accounts manually and generate TOTP codes on the watch. Managing accounts on a computer and securely transferring selected ones without cloud sync is planned; the transfer workflow is still being designed. Desktop-2FA remains free and open source. Watch is planned as a separate paid app. See the Watch development update.

What Python version do I need?

Python 3.11 or newer.

Where can I find command help or report a problem?

Run d2fa --help or d2fa COMMAND --help. Report issues in the GitHub issue tracker.