← All downloads

Richey Authenticator

Your two-factor codes, generated on your phone, backed by your own server. Offline. Biometric-locked. No cloud, no tracking.

⬇ Download for Android v1.3
Android 7+ · 3.2 MB · sideload (not on Play Store by design)
SHA-256 a5472acc52b60b93ab2fcae15413db7c16e53068c6b455992e67ba86ebf88eb9

Why it's different

Most authenticators trust a company's cloud. This one trusts you.

📴

Works offline

Codes are computed on your device from your secrets — no signal needed, ever. Syncs your account list from your server when it can.

👆

Biometric lock

Face or fingerprint to open, with a 6-digit PIN fallback. Your codes stay hidden even when your phone is unlocked.

🏠

Your own server

Backed by your self-hosted 2FAuth. Add/manage accounts there; the app mirrors them, privately.

🖼️

Real service logos

Recognizable brand icons for your accounts, pulled straight from your server.

🔐

Encrypted backup

Export an encrypted backup (AES-256, your passphrase) and restore on any device in seconds — no lock-in, no deadlock.

🚫

No cloud, no analytics

Nothing is sent anywhere except your own server. No trackers, no ads, no accounts to sign up for.

Get started in a minute

You'll need a self-hosted 2FAuth server and a personal access token from it.

  1. Create a token — in 2FAuth: Settings → Manage API access tokens → New token. Copy it.
  2. Install the app — download above, open the file, allow "install from unknown sources" if asked.
  3. Connect — open the app, confirm your server URL, paste the token, tap Connect & Sync.
  4. Lock it down — set a 6-digit PIN; after that it opens with your fingerprint or face.
  5. Done — your codes appear with live countdown rings. Tap any code to copy it.

Built for privacy & recovery

Security choices you can actually verify.

On-device only

Secrets are used to compute codes locally and are never transmitted anywhere but your server during sync.

RFC 6238 TOTPSHA-1/256/512

Excluded from device backup

allowBackup=false keeps your secrets out of Google/Samsung/SeedVault backups. Recovery is your encrypted export instead — under your control.

Encrypted, portable recovery

Your backup is AES-256-GCM with a key derived from your passphrase (PBKDF2, 200k iterations). Store it anywhere; it's useless without the passphrase.

💡 Recovery tip: after setup, do Settings → Export encrypted backup and keep the blob somewhere safe (a note, a USB key, a second cloud). If you ever wipe your phone, Restore from backup brings everything back — no server login required.

Questions

Is this on the Google Play Store?

No — by design. It's distributed as a direct download so it never touches Google's review or your Play account. You sideload it from here.

Do I need a 2FAuth server?

Yes. This is a client for your own 2FAuth instance. You manage accounts there; the app gives you offline, biometric-locked access to the codes.

What if I lose my phone?

Your accounts live on your server, and your encrypted backup restores instantly on a new device. As long as you have your server token (or your backup + passphrase), you're covered.

Why does an account show a letter instead of a logo?

That account simply has no icon set in 2FAuth. Add or fetch a logo for it in the 2FAuth web UI, then re-sync (⟳) in the app.

Is my data encrypted in transit?

Yes — all server communication is over HTTPS. The app authenticates with your 2FAuth personal access token.