Open-Source 2FA Built on Zero-Knowledge Trust.
Protect your accounts with military-grade client-side encryption. Oakstree Authenticator generates standard TOTP tokens locally with biometric gate unlocks and encrypted cloud backup where only you hold the keys.
Server-Side Knowledge
Industry TOTP Standard
Hardware-Backed Keystore
Offline Operable
How Authenticator Protects Your Accounts
Engineered for privacy purists, cybersecurity teams, and everyday users who demand unbreakable protection.
Zero-Knowledge Architecture
Your secret seed keys are encrypted locally on your device with your master passphrase before any optional cloud sync occurs. We never hold your decryption keys.
Biometric Gate Unlock
Fast, frictionless access with fingerprint and Face ID authentication. Secure Enclave / Android Keystore hardware protection ensures private keys remain isolated.
Instant QR & Key Import
Add accounts in seconds by scanning standard 2FA QR codes from Google, GitHub, AWS, Microsoft, and thousands of services, or input secret keys manually.
Encrypted Multi-Device Sync
Keep your desktop, tablet, and mobile devices in sync with end-to-end encrypted backup. If you lose your phone, your keys remain safe and recoverable.
100% Offline Generation
Generates RFC-compliant 6-digit and 8-digit codes completely offline with zero active internet connectivity required. Pure mathematical precision.
Open-Source Verifiability
Transparent codebases allow security researchers and enterprise teams to independently audit encryption routines and confirm the absence of telemetry backdoors.
How Zero-Knowledge Protection Operates
Traditional authenticators send unencrypted account labels or cloud backups to centralized server infrastructure. Oakstree Authenticator executes a rigorous cryptographic pipeline:
- Key Derivation: Your master password passes through 100,000+ rounds of PBKDF2 with SHA-256
- Vault Sealing: Account secrets are encrypted via authenticated AES-256-GCM cipher
- Hardware Isolation: Decryption keys reside exclusively in device secure enclaves
Even if our cloud servers are compromised, your 2FA keys remain mathematically unreadable.
Because decryption occurs strictly in-memory on your local hardware device using keys derived from your personal master passphrase, no third party — including Oakstree engineers — can access your tokens.
Upgrade to Zero-Knowledge Authentication
Protect your enterprise access credentials with Oakstree Authenticator.