TwoFactorAuth
macOS SwiftUI App (2FA / TOTP) — secure, offline two-factor codes that never leave your Mac
TwoFactorAuth is a native macOS two-factor authentication client built entirely in SwiftUI, designed around a simple principle: your second factors should never leave your machine. The app generates time-based one-time passwords locally and stores every secret inside the macOS Keychain, so credentials are protected by the same hardware-backed security enclave that guards the rest of the operating system. There is no account to create, no cloud sync, and no analytics phone-home — the moment you launch it, the app is fully functional and fully offline.
Under the hood the generator implements RFC 6238 TOTP (and HOTP for counter-based accounts) and supports SHA1, SHA256 and SHA512 digests, so it works with the full range of issuers including those that require stronger hash algorithms. Adding accounts is designed to be painless: scan a QR code with the built-in camera capture, paste an otpauth:// URI, or import a database directly from Google Authenticator to migrate dozens of entries in one move. Codes refresh on a rolling 30-second window with a clear progress indicator and, for accounts that need it, support for custom time steps and digit lengths.
Choosing SwiftUI kept the entire codebase in Swift and let the UI stay native rather than wrapped in a web view — menus, keyboard navigation, dark mode and accessibility all come from the platform for free. The interface stays deliberately minimal: a searchable list of accounts grouped by issuer, large monospaced codes for quick reading, and a dark palette that is easy on the eyes during late-night sessions. For anyone who wants authentication that respects privacy and never depends on a server, TwoFactorAuth is the macOS answer.
Key features
- RFC 6238 TOTP and HOTP generation with SHA1, SHA256 and SHA512 support
- Secrets encrypted and stored in the macOS Keychain — no plaintext database
- QR code scanning via camera plus
otpauth://URI and manual secret entry - One-click import from Google Authenticator for painless migration
- Fully offline operation with no accounts, no sync and no telemetry
- Native dark mode, searchable account list and keyboard-friendly navigation
Technology stack
About the developer
TwoFactorAuth is built by Harsh Kadyan, a 22-year-old full stack developer and AI engineer from Rohtak, Haryana who codes under the alias BrutalHarsh. His work ranges from native macOS and mobile apps to large backend systems and AI automation, always with an eye for security and clean engineering. Read more on the about page.