Self-hosted Authy alternative: own your 2FA codes with 2FAuth

Two-factor authentication is the one security control most people actually use, and it quietly became a form of lock-in. The app that holds your TOTP seeds holds the keys to everything you own — email, bank, domain registrar, the lot. Authy made that vault a cloud service, then killed its desktop app in 2024 and left a lot of people re-enrolling every account by hand, because Authy never shipped an export button in the first place. Your second factor shouldn't live on someone else's roadmap. 2FAuth is the same idea — a vault for your codes — except you run it.

What 2FAuth is

2FAuth is a web-based vault for your two-factor codes. Point a browser at it — phone, laptop, tablet — log in, and it generates the same rotating TOTP and HOTP codes any authenticator app produces, from a vault that lives on your server instead of a vendor's. It is not a stripped-down demo. It handles the standard otpauth accounts every service issues, stores an icon and a group for each one, can encrypt the secrets at rest, and exposes a REST API and a browser extension so a code is a keystroke away. Where Authy gave you a closed mobile app and a cloud you couldn't inspect, 2FAuth gives you the whole thing — the accounts, the database, the export button — as software you host and control. It's built on Laravel, ships as a Docker image, and runs comfortably on very little.

The features that actually matter

• TOTP, HOTP, and Steam — Generates both the time-based codes almost every service uses and the counter-based HOTP variant, plus Steam's non-standard token format, so nothing in your account list is left stranded.
• Bulk import, where an export exists — Pull accounts in from 2FAS, Aegis, Google Authenticator's export QR, or plain otpauth URIs, all at once instead of one at a time. Authy is the exception, and not 2FAuth's doing: it never shipped an export, so those accounts get re-added by hand wherever you land.
• QR scanning from the browser — Add an account by uploading its QR image or capturing it with your device camera, the same flow you'd use on a phone app.
• Encrypted secrets at rest — The seeds in the database can be encrypted with your app key, so a stolen database dump isn't a stolen set of accounts.
• Passwordless login with WebAuthn — Sign in with a passkey or a hardware security key, and require 2FA on 2FAuth itself, so the vault guarding everything is guarded too.
• Groups, icons, and search — Organize accounts into groups, attach recognizable logos, and filter a long list instantly — the kind of polish that stays free here rather than sitting behind a tier.
• REST API and a browser extension — A documented API with personal access tokens, plus a companion extension for Chrome and Firefox, so codes reach your workflow without alt-tabbing to a phone.
• Runs anywhere, exports anytime — A mobile-friendly PWA backed by SQLite, MySQL, or PostgreSQL, with your accounts exportable whenever you want and no cloud in the loop.

Why self-host it instead of the hosted version

Your seeds never leave your server. A 2FA vault is the highest-value target you own — the thing standing between an attacker and everything else. Handing that to a third-party cloud means trusting their breach response, their retention, and their business model with your most sensitive secrets. Self-hosted, the seeds sit in a database you control and can encrypt.

The cost doesn't scale per seat. Cloud authenticators monetise teams per user per month. 2FAuth is free software; a household or a small company runs one instance for everyone at the cost of a small container. Its multi-user mode gives each person an isolated vault under one admin, so shared hosting doesn't mean shared codes. Adding your tenth family member or fiftieth employee changes nothing on the bill.

It's yours to shape. Your domain, your login policy, your branding, your backup schedule. No forced app retirement, no surprise migration deadline, no feature you depended on disappearing because it stopped fitting someone's roadmap. It's open source, so even if the project ever stalled, the code and your data would both stay in your hands. When the tool is yours, so is its future.

Who it's for

• People burned by Authy's shutdown who re-added their accounts by hand once and want a permanent home for them that no vendor can retire out from under them.
• Families and small teams who want everyone on real 2FA without paying per-seat for a cloud dashboard — one instance, shared or per-user accounts, one predictable cost.
• Privacy-minded self-hosters already running their own stack, who see no reason the single most sensitive credential store they own should be the one thing left in someone else's cloud.

The honest setup notes

Running it yourself means owning a few real chores. It needs a database — SQLite is fine for one person, but a multi-user instance wants MySQL or PostgreSQL, which is one more thing to back up. You'll want SMTP configured for email verification, password resets, and admin notices, which means an outbound mail path that actually delivers. And because this is a security app, HTTPS is non-negotiable and your encryption key and backups matter more than usual — lose the vault with no backup and you've lost your second factor everywhere at once. Keep each account's recovery codes somewhere outside 2FAuth so the vault isn't a single point of failure. None of it is exotic, but it's a standing responsibility: patches, renewals, backups, forever.

Or let us run it. On Caliber Node the database, mail, TLS, and updates are handled, and you still get the vault, the export button, and full control of your data.

Deploy it in one click

Rolling your own means provisioning a host, installing PHP and Laravel, wiring up a database, generating an app key, configuring SMTP, terminating TLS, and then keeping all of it patched — a reasonable weekend for someone who enjoys it, and a genuine liability for someone who doesn't.

On Caliber Node it's a button. We provision the container, attach the database, terminate TLS on your subdomain, and hand you a running vault with the credentials in front of you. You can deploy 2FAuth in one click and be adding accounts in minutes, with real logs, SFTP access, and a database you can export whenever you like. The managed part is the plumbing — the vault, the codes, and the data stay entirely yours.

First run

1. Open your instance and create the first account — this becomes the admin user, so pick a strong password and, ideally, register a passkey right away.
2. Turn on 2FA for 2FAuth itself, so the vault guarding your accounts is protected the same way everything inside it is.
3. Import your existing accounts from a 2FAS, Aegis, or Google Authenticator export, or scan a fresh QR straight from the browser.
4. Add an icon and a group to your first account so a long list stays readable at a glance.
5. Copy a live code to confirm it matches what the service expects, then export a backup and store it somewhere safe.

The bigger picture

Two-factor authentication is supposed to be the thing you can count on, which makes it exactly the wrong place to accept lock-in, cloud dependence, or a vendor's decision to sunset the app you rely on. Owning the vault that protects every other account you have isn't paranoia — it's the natural end of taking your own security seriously. 2FAuth makes that ownership ordinary: your codes, your server, your export button, reachable from any browser.

Deploy 2FAuth in a few minutes →

Browse the full app catalog

One-click self-hosted apps, managed for you — real logs, SFTP, and your data always exportable. Never a black box.