Security
AuthGeek: a desktop TOTP authenticator with an Argon2 vault and no cloud sync
Andrew Armstrong Dev.to (EN Zone)
1 views
Hi DEV!
I was fed up picking up my phone to type a six digit code into the machine I was already sitting at. The desktop authenticators I tried either wanted an account, synced my secrets to their cloud, or both, which rather defeats the point of the thing being under my control.
AuthGeek is a TOTP and HOTP authenticator that keeps everything local:
Secrets in a local vault, encrypted with Argon2id
Add accounts by scanning a QR code off the screen, or paste the secret
Encrypted backup and restore, so you are not locked into one machine
No account, no sync, no telemetry
Why I built it
The design brief was one sentence: nothing about my second factor should require somebody else's server.
I want to be straight about the trade though. Keeping codes on the same machine you log in from is weaker than a separate phone. If your PC is compromised, both factors are on it. For a lot of threat models that is fine, for some it is not. If it is not, keep using your phone, and I would rather say that than pretend otherwise.
Tech stack
.NET 8, net8.0
Avalonia for the UI
Konscious.Security.Cryptography.Argon2 for the vault key derivation
ZXing.Net for QR decoding
Argon2id over PBKDF2 because the whole value proposition here is the vault, and memory hard is the right default in 2026.
Honest caveat
The installer is not code signed yet, so SmartScreen may warn on first run. For a security tool I appreciate that is a worse look than usual. It is on the list.
Links
Site: https://techygeekshome.info/authgeek/
Source: https://github.com/techygeekshome/AuthGeek
Video: https://youtu.be/HtrjpdrUe-g
If you spot something wrong in the crypto, please open an issue rather than being polite about it.
Read original: https://dev.to/techygeeks1/authgeek-a-desktop-totp-authenticator-with-an-argon2-vault-and-no-cloud-sync-2dbp
← Previous
Cloud in a Bottle: making self-hosting accessible to everyone
Next →
I Built an Autonomous AI Agent That Hunts Bounties. Here's What Happened.
Related
H
Hermes Agent Security: What Can Your MCP Tools Reach?
Security
0
DEV Community
1
13 findings no Juice Shop. Nenhuma virou issue.
Security
0
DEV Community
W
Why QR Pairing Beats IP Addresses for Local-First Device Sync
Security
0
Dev.to (EN Zone)
S
Saving a Real File From Flutter Web, Instead of Downloading Another Copy
Security
0
Dev.to (EN Zone)
Comments0
No comments yet — be the first