Back to catalog
Ente Auth
AGPL-3.0Open-source, end-to-end encrypted 2FA authenticator replacing Authy with multi-device sync, audited cryptography, and cross-platform desktop clients.
Open-source alternative to — compare it against:
Overview
A DevOps engineer managing infrastructure credentials, source repositories, and cloud consoles needs two-factor codes across workstations without trusting a proprietary cloud with unencrypted secrets. When commercial authenticator providers deprecate desktop clients or suffer credential leaks, closed sync tools become an operational liability. Ente Auth solves this dilemma through audited client-side encryption and synchronization across mobile, desktop, and web platforms.
Why Ente Auth instead of Authy
Authy captured developer mindshare by synchronizing one-time passwords across devices, but its model relies on closed infrastructure and phone-number identity. Twilio's decision to discontinue Authy's desktop apps forced engineers to reach for a smartphone for every workstation login. Authy also withholds an export function, locking seed values inside its database and leaving accounts vulnerable to telecom risks like SIM swapping.
Ente Auth restores desktop workflows while replacing vendor trust with zero-knowledge architecture. Instead of binding accounts to carrier phone numbers, it identifies users by email and derives keys locally using Argon2id and XSalsa20-Poly1305. While Authy retains an edge in proprietary push notifications for Twilio Verify, Ente Auth provides verifiable data ownership. Secrets export to standard JSON at any time, and encrypted tokens synchronize to Linux, macOS, and Windows clients without vendor lock-in.
What it does well
- End-to-end encrypted synchronization: Secrets are encrypted locally before transit, preventing cloud providers or hosting operators from viewing stored TOTP tokens.
- Native multi-platform support: Dedicated apps for Android, iOS, Linux, macOS, and Windows let engineers copy codes within workstation environments without switching devices.
- Unrestricted data export: The app exports tokens into plain or encrypted JSON formats, ensuring teams retain full ownership of their credential seeds.
- Time-limited token sharing: Administrators can generate encrypted, expiring links that share temporary one-time codes without revealing underlying secret seeds.
- Audited cryptography: Independent code audits by Cure53 and Symbolic Software verified protocol integrity and client-side key derivation.
- Command-line automation: A dedicated CLI enables developers to script token extraction and integrate backups into terminal workflows.
