KeyHarborAuthenticator

SELF-HOSTED · INDEPENDENT BY DESIGN

A safe harbor for
your second factor.

Your codes. Your server. Your control.

Standard authenticator codes in an encrypted vault you manage yourself.

Browser-side encryptionNo cloud accountEncrypted backups

Connecting to your vault…

Open an encrypted backup read-only

Decrypts on this device only. Nothing is imported or uploaded. Also works with this app served locally for emergency recovery.

Add an authenticator

Read a setup QR or URI

QR images are decoded on this device, not uploaded. Use an individual TOTP setup QR; proprietary push and bulk-export QR formats are not supported.

Advanced settings

Keep your existing authenticator until a code from this vault successfully signs you in.

Import an encrypted backup

Accounts are merged. Matching setup keys and code settings are skipped; existing accounts are not replaced.

Change master passphrase

Other server sessions will be revoked. Previously downloaded backups still need their old passphrase. Already-unlocked copies cannot be remotely erased.

About KeyHarbor Authenticator

Version 0.2.0 · Self-hosted browser application

Add to your home screen

On iPhone or iPad, open your HTTPS address in Safari, use Share, then Add to Home Screen. On supported Android or desktop browsers, use Install app or the browser's install menu.

This version still needs your server when you open it. Installing an icon does not create an offline vault, biometric unlock, or a native store app.

Backups and recovery

Export an encrypted backup and keep it separately. The read-only recovery option on the lock screen uses local application files and your backup when the original server is unavailable.

No cloud account or telemetry. Never keep the only recovery method for this server inside this vault. This preview has not been independently security-audited.