Back to catalog
Authenticator
GPL-3.0Open-source Linux 2FA app replacing Authy's discontinued desktop client with local encrypted vaults, GNOME Shell search, and on-screen QR scanning.
Open-source alternative to — compare it against:
Overview
Authenticator is built in Rust with GTK4 and Libadwaita to provide native two-factor authentication on Linux. Maintained under the GNOME World initiative, the application stores one-time passcodes in locally encrypted vaults rather than external clouds. For developers and DevOps engineers handling frequent terminal and browser logins, it integrates with desktop search and screenshot capture without requiring a phone.
Why Authenticator instead of Authy
When Twilio discontinued the Authy desktop app, engineers lost workstation access to two-factor passcodes and were pushed back to phones. Authenticator restores keyboard-driven workflows by integrating into the desktop via GNOME Shell search. Pressing the Super key and typing a service name surfaces the active token immediately, letting engineers copy codes into terminal or browser prompts without opening the application window. Its desktop portal integration also decodes enrollment QR codes directly from the screen, eliminating the need to scan monitors with a phone camera.
This integration contrasts with Authy's closed cloud model. Authy binds accounts to phone numbers, synchronizes tokens through Twilio servers, and withholds an export feature. Authenticator stores token data in an encrypted local database unlocked via the system keyring or an application passphrase. In exchange for local custody, teams give up automatic multi-device sync; moving tokens between machines requires manual file exports or tools like Syncthing. However, Authenticator prevents lock-in by importing vaults from Aegis, Google Authenticator, and FreeOTP while offering standard exports.
What it does well
- GNOME Shell search provider: Query active tokens from the desktop overview and copy codes into terminal sessions without opening the application window.
- On-screen QR code capture: Uses portal screenshot APIs to decode setup codes from browser windows, accelerating MFA enrollment for AWS, GitHub, and Cloudflare.
- Multi-algorithm support: Generates RFC 6238 TOTP and RFC 4226 HOTP tokens across SHA-1, SHA-256, and SHA-512 hashes to meet corporate security policies.
- Steam Guard compatibility: Generates alphanumeric Steam tokens, assisting developers who manage gaming platforms alongside standard cloud infrastructure.
- Local cryptographic storage: Encrypts secrets locally with AES, unlocking via the system secret service daemon or a master passphrase.