Keya Authenticator

Free and open-source 2FA. No ads, no subscription, no tracking. Encrypted backups, Face ID/Touch ID. Your tokens stay on-device. Swipe tokens to edit, delete, or export.

Your passwords alone aren't enough. Every account worth protecting deserves a second lock, one that never phones home.

Keya Authenticator generates secure one-time codes for any site that supports two-factor authentication, with no account to create, no server to trust, and no subscription to cancel.

PRIVATE BY DESIGN Every secret you add stays in the iOS Keychain, encrypted, locked to your device, and invisible the moment your screen goes dark. Keya Authenticator has zero network entitlements, so it physically cannot connect to the internet.

NEVER RACE THE CLOCK Most authenticator apps leave you scrambling when a code is about to expire. Keya shows you the next code before the current one runs out, so you always have time to type it in.

BIOMETRIC UNLOCK Protect your codes with Face ID or Touch ID, with a PIN fallback always available and automatic lockout after repeated wrong attempts.

EASY TO SWITCH Moving from another app is painless: import directly from Google Authenticator, Aegis, 2FAS, Raivo, andOTP, or LastPass, or just scan any standard QR code.

ENCRYPTED BACKUPS Export your entire vault as an AES-256-GCM encrypted backup and store it anywhere you like. No cloud account required.

OPEN SOURCE Every line of code is publicly available on GitHub under the GPL v3 license, so you can read it, audit it, or build it yourself. That's what trust through transparency actually looks like.

FREE, FOREVER There are no ads, no subscription, and no freemium tricks: every feature is available from day one. A voluntary tip jar is the only way to support development, and it's entirely optional.

WORKS WITH EVERYTHING Google, GitHub, Apple, Microsoft, Dropbox, Amazon, Discord, and hundreds more: any service built on TOTP (RFC 6238) or HOTP (RFC 4226) works here.