2FAuth

What is 2FAuth?

2FAuth is a self-hosted web app that stores your two-factor authentication secrets and generates their one-time codes. You add an account by scanning or importing a QR code, and 2FAuth produces the current TOTP, HOTP, or Steam Guard code from any browser you sign in on. It’s built on Laravel (PHP).

What is 2FAuth best for?

People and small teams who want their 2FA codes in a place they control instead of locked to a single phone. It fits self-hosters who already run other authentication tools, a shared instance for a household, or a browser-accessible backup to a phone-based authenticator.

What can 2FAuth do?

• Generate TOTP, HOTP, and Steam Guard one-time codes (RFC 6238 / RFC 4226)
• Add accounts by scanning or decoding a QR code, or entering the secret by hand
• Organize accounts with groups, icons, search, and filtering
• Import from Google Authenticator, Aegis, 2FAS, and its own JSON export, plus back up and export your data
• Log in with a password or a passkey/FIDO2 key (YubiKey, Titan), and add SSO via OpenID or GitHub and an authentication proxy
• Manage multiple users with isolated personal vaults and control over registrations
• Automate with a REST API and personal access tokens, and capture secrets with the Chrome/Firefox browser extension
• Encrypt secrets at rest, auto-lock idle sessions, and keep auditable access and OTP-generation logs

Where does 2FAuth fall short?

• It’s a web app, not a phone app. You reach your codes through a browser, the PWA, or the extension against your running instance — so unlike Google Authenticator or Authy there’s no offline authenticator in your pocket, and if the server is unreachable, so are your codes.
• It concentrates every 2FA secret on one server. Turn on the optional database encryption — without it the secrets sit in your database in recoverable form, and a compromised host exposes all of them at once. The project’s own guidance notes a shared multi-user instance is riskier than one vault per person for this kind of app.
• There’s no built-in encrypted multi-device cloud sync like Authy’s. Codes live on your instance by design, so “syncing” across devices really means every device pointing at the same server.

Is 2FAuth free?

Yes — 2FAuth is free and open source under the AGPL-3.0 license, with no paid tier and no hosted cloud edition. You run it on your own server, so the only cost is the hosting it sits on. A public demo lets you try it before installing.

What does 2FAuth replace?

2FAuth stands in for phone-based authenticator apps like Google Authenticator and Authy. It does the same job — holding your TOTP and HOTP secrets and generating codes — but on a server you control and reachable from any browser, rather than tied to one device or a vendor’s cloud. If you’d rather keep codes next to your logins, a password manager like Vaultwarden can also store TOTP secrets.

FAQ

Is 2FAuth open source? Yes. 2FAuth is licensed under AGPL-3.0, so the full source is public and free to self-host, use, and modify — the AGPL requires you to share source for any modified version you offer to others over a network.

Can I self-host 2FAuth for free? Yes. It’s free software with no paid edition, so you only pay for the server it runs on. Official Docker and Docker Compose images make setup straightforward, and there’s a Heroku path too.

Is 2FAuth a good Google Authenticator alternative? For self-hosters, yes — you gain browser access, import/export, groups, and multi-user support that Google Authenticator lacks. If you just want a simple offline app on one phone, a mobile authenticator like Aegis or 2FAS may be simpler.

What do I need to run 2FAuth? A server with PHP 8.4+ and a database supported by Laravel (MySQL, PostgreSQL, or SQLite), or just Docker. It follows standard Laravel server requirements.