Back to catalog
Clockode
GPL-3.0Clockode is an offline Linux TOTP authenticator in Rust that replaces Authy with local KeePass encryption and standard Aegis backup compatibility.
Open-source alternative to — compare it against:
Overview
Spanish software developer Alex Marín created Clockode to provide a native Linux desktop authenticator that generates two-factor authentication codes without cloud dependencies. Built in Rust with the Iced framework, the tool stores credentials in a local KeePass vault instead of locking secrets behind proprietary accounts. That architecture keeps token generation offline, private, and under direct developer control.
Why Clockode instead of Authy
Authy pairs two-factor authentication with Twilio cloud servers, requiring phone-number verification and routing token sync through closed APIs. Following Twilio deprecation of its desktop client, Linux workstation users lost native support entirely. Authy also isolates credentials inside a proprietary format, preventing developers from exporting tokens into local scripts or standard backup archives.
Clockode focuses on open platform integrations. It encrypts secrets inside standard KeePass KDBX4 databases using keepass-rs, allowing DevOps engineers to inspect or back up credentials with KeePassXC and existing infrastructure tools. Desktop integration extends to camera access: Clockode connects through ashpd and PipeWire to scan QR codes without direct /dev/video access. It lacks Authy managed multi-device cloud server, but an internal filesystem watcher automatically reloads entries whenever utilities like Syncthing update the database file.
What it does well
- Standard KeePass storage: persists tokens in an encrypted KDBX4 database, letting engineers inspect and back up credentials using KeePass-compatible tools.
- Multi-process database reloads: watches the vault file to reload authentication entries automatically when Syncthing or rsync updates disk contents.
- Air-gapped Flatpak packaging: omits network socket permissions entirely, ensuring token calculations never emit traffic across local networks or the internet.
- Portal-mediated camera scanning: uses PipeWire and XDG Desktop Portals to read setup QR codes via webcams without broad device privileges.
- Interoperable backup exchange: imports and exports standard Aegis JSON backups to move tokens between Linux workstations and Android devices.
- Workstation keyboard ergonomics: includes Tab switching, Enter confirmation, Esc navigation, and rapid clipboard copying for terminal authentication.
