2FA secrets in your own database, codes in any browser
2FAuth is a PHP web app, built on Laravel, that stores two-factor accounts in a database on your server and generates their TOTP, HOTP and Steam Guard codes in a browser tab. Its README calls it a self-hosted alternative to OTP generators like Google Authenticator, designed for phones and desktops alike. A public demo, wiped every hour, is open to anyone who wants to look around before installing.
Import from other authenticators, share codes but keep the secret
- OTPs follow RFC 4226 (HOTP) and RFC 6238 (TOTP), computed by Spomky-Labs' OTPHP library. Steam Guard codes work too.
- New accounts come from a live QR scan, an uploaded QR image or an advanced form, and imported accounts stay editable.
- Imports read Google Authenticator migration QR codes and exports from Aegis, 2FAS, Bitwarden and, since v9.0.0, Ente Auth. Exports are JSON.
- Since v7, an owner can share an account with other users of the instance. They generate codes but never see the secret or its QR code, and a log records who asked for a code and when, without keeping the code itself.
- Sign-in by password, WebAuthn security key (YubiKey, Titan), OpenID or GitHub SSO, or through an authentication proxy.
- Auto lock after inactivity or as soon as a code is copied, and codes can be shown as dots against shoulder surfing.
- Firefox, Chrome and Edge extensions pull codes from the server and capture QR codes on the current page, and a documented API is there for scripts.
Codes at the desk, revocable access for a team
- Reading a code at a desktop without hunting for the phone.
- Keeping 2FA accounts in a database you back up and restore yourself, so a lost phone doesn't take them with it.
- Giving a team codes for a shared supplier account, then revoking access without rotating the secret on the service side.
- Handling 2FA for a relative who finds it confusing, an example the sharing docs give.
Guard the APP_KEY, read every major release note
The target is one person or a small team. The documentation site describes 2FAuth as an OTP manager for individuals and teams. It recommends SQLite for a single user or a handful of them, and a server database past that. Sharing is off by default and only works between accounts registered on the same instance.
Losing APP_KEY makes encrypted secrets unusable. Encrypting secrets in the database is opt-in, off by default, and uses the APP_KEY environment variable as its key. The docs put it plainly: without that key no OTP can be generated, and there is no workaround.
An auth proxy has to be the only way in. In proxy mode, 2FAuth logs in whichever user the REMOTE_USER header names and only checks that the header is there. The docs therefore require the instance to be reachable through the proxy alone, which since v8 must be listed in TRUSTED_PROXIES, and they name the Authelia portal as one server to put in front. Proxy mode rules out WebAuthn and personal access tokens, and a personal access token is how the browser extension binds to an account.
Four major versions shipped in 2026. v9.0.0 came out on October 27, 2026, after v6 in January, v7 in June and v8 in July. Some of those jumps needed admin action: v8 invalidated personal access tokens as part of its Laravel upgrade, and v6 removed the default APP_KEY from the Docker image and dropped PHP 8.3. Installing without Docker requires PHP 8.4 and Composer.