Seven x2y tools remain free. Code Leak Detector is $29 as a one-time purchase.
View productsOffline 2FA Vault for Android
Offline by choice. Secure by design. A high-security offline 2FA vault with Stealth Mode, encrypted Panic Backups, and WiFi Companion for seamless desktop access.
Free — no account, no cloud sync, no telemetry. Your secrets never leave your device.
At a glance
Codes are generated on-device from locally stored secrets. Nothing syncs, so there is nothing to breach on a server.
Security features
TOTP codes are computed entirely on-device using locally stored secrets and the system clock. The application has no network permissions and makes zero outbound connections. Airplane mode is the recommended operating environment.
Configure a secondary PIN that opens a decoy vault populated with fake accounts. Under coercion, hand over the duress PIN — your real secrets remain invisible and inaccessible. The attacker sees a convincing but worthless vault.
Export your entire vault as an encrypted backup protected by a master recovery key rendered as a QR code. Store the QR physically — in a safe, with a lawyer, split between trusted parties. Restore from it on any device running x2y Authenticator.
Unlock the vault with a numeric PIN, fingerprint, or both. Biometric data never leaves the Android Keystore — x2y Authenticator only receives a yes/no authorisation result from the hardware-backed secure enclave.
Convenience features
Need a code on your desktop? The WiFi Companion securely streams TOTP codes from your phone to a PC browser over your local network. No cloud relay, no internet hop — the connection stays within your LAN and uses end-to-end encryption.
Organise accounts into colour-coded categories. Switch between Work, Finance, Social and custom folders instantly. Each folder can have its own lock timeout and visibility rules.
Two recovery paths: scan the Master QR code generated during Panic Backup setup, or import an encrypted .x2y backup file. Both methods restore the full vault with all accounts, folders and settings intact.
TOTP codes depend on accurate time. x2y Authenticator optionally syncs against NTP servers to correct clock drift — the sync fetches only a timestamp, no personal data is transmitted, and it can be disabled entirely for air-gapped use.
Specifications
| Product | x2y Authenticator |
|---|---|
| Version | v1.2.0 |
| Platform | Android |
| Protocol | TOTP (RFC 6238) |
| Storage | On-device encrypted vault (Android Keystore) |
| Sync | None by design — no cloud, no server |
| Authentication | PIN + Biometric (fingerprint via Android Keystore) |
| Stealth Mode | Duress PIN opens decoy vault with fake accounts |
| Backup | Encrypted Panic Backup via Master QR or .x2y file |
| Import | Manual secret entry, otpauth QR scan |
| WiFi Companion | LAN-only encrypted stream to PC browser |
| Folders | Work, Finance, Social + custom categories |
| Time sync | Optional NTP (timestamp only, disableable) |
| Network permissions | None required for core operation |
| Telemetry | 0 bytes — verified continuously |
| Account required | None — ever |
| Price | Free |
| Developer | x2y Devs Tools Ltd, Nairobi, Kenya |
Quick start
Download the signed APK from Uptodown or APKPure. Enable installation from unknown sources if prompted. Verify the SHA-256 checksum before installing.
Create a vault PIN on first launch. Optionally enable fingerprint unlock. Configure a separate duress PIN for Stealth Mode if desired.
Scan an otpauth QR code from any service's 2FA setup page, or enter the secret manually. Assign each account to a Smart Folder (Work, Finance, Social).
Generate your encrypted Master QR recovery key. Store it physically — safe deposit box, sealed envelope, split between trusted parties. This is your lifeline if the device is lost.
Downloads
Release history
The current build is v1.2.0. Every earlier version keeps its published notes — switch to v1.0.0 and the original notes open exactly as they shipped in March 2026.
The Trust Update. Reliable biometric unlock, segmented Master QR restore for large vaults, PBKDF2-HMAC-SHA256 backup key derivation with 100,000 iterations, FLAG_SECURE screenshot protection across the app lifecycle, optional local security reminders and .x2y restore validation. No new packages. Read the v1.2.0 release notes.
The Powerhouse Update. HOTP accounts, native Steam Guard, migration from Google Authenticator, Aegis and andOTP, 30-day trash recovery, favorites and pins, batch operations, Vault Insights, wrong-PIN lockdown and Companion history controls. v1.1.0 release notes.
Security & Usability Release. Security Center, Backup v2 with SHA-256 integrity checksums, salted SHA-256 PIN storage, auto-lock, clipboard protection, Companion sessions, the Material 3 vault redesign, diagnostics and brand recognition. v1.0.5 release notes.
Initial release. Offline TOTP vault with PIN and biometric authentication. Stealth Mode with duress PIN and decoy vault. Encrypted Panic Backup via Master QR and .x2y file. Smart Folders (Work, Finance, Social). WiFi Companion for LAN-only code streaming to PC browsers. NTP time sync (optional, timestamp only). Zero network permissions for core operation. v1.0.0 release notes.
Security model
x2y Authenticator was designed around a single threat model: your secrets are safest when they exist in exactly one physical location that you control. There is no cloud copy to breach, no sync server to subpoena, no analytics pipeline to leak through. The WiFi Companion is the only feature that uses the network, and it operates exclusively within your local area network with end-to-end encryption — no packets leave your router.
| Telemetry | 0 bytes collected |
|---|---|
| Account | None required — ever |
| Cloud sync | None — by design |
| Secret storage | Android Keystore (hardware-backed) |
| Network perms | None for core operation |
| WiFi Companion | LAN-only, end-to-end encrypted |
| Backup | Encrypted locally, never transmitted |
| Duress protection | Stealth Mode with decoy vault |
Design notes
x2y Authenticator implements time-based one-time passwords exactly as RFC 6238 defines them: a shared secret plus the current clock, hashed into a six-digit code. That computation needs no network, and adding one would only create an attack surface and a business decision about where your codes live.
So there is no sync service, no recovery mailbox, no vendor database. If an authenticator app offers cloud backup, the honest question is not whether it encrypts the backup but who holds the key and what legal process can reach it. Here the answer is nobody but you.
Vault secrets are encrypted at rest using the Android Keystore, and unlock is gated by your PIN or fingerprint through the same hardware-backed path. The app asks for no permissions beyond local storage for the encrypted vault, and none at all for the core operation of producing codes.
A passphrase-only vault is vulnerable while the device is unlocked; a Keystore-backed vault is not readable by another app on the same phone. That distinction is the whole reason this is a native Android app rather than a cross-platform wrapper.
A duress PIN opens a decoy vault containing accounts you chose to expose. It is a real mitigation for a specific, unlucky situation — being forced to unlock your phone — and it is deliberately described as a mitigation, not a guarantee. An attacker who can compel you to give the real PIN still wins; Stealth Mode only removes the free look.
We would rather under-promise here than sell you a magic button. The behaviour, the decoy setup and its limits are documented in the product reference.
Backups are encrypted and exported as a Master QR or a .x2y file. You decide whether that ends up in a safe, a bank deposit box or an encrypted drive. Losing the phone is survivable; losing both the phone and the backup is not — that is the cost of refusing to hold your recovery in our servers, and we think it is the right trade.
Typing six digits on a phone while a desktop login times out is the classic friction point. WiFi Companion streams the current code to a browser on the same local network over an encrypted LAN connection — no relay, no vendor server, and it can be switched off entirely.
Similarly, optional NTP time sync requests a timestamp only, so codes stay accurate after a long flight; disable it and your clock drift is your own business.
How it works
Sideload the signed APK from Uptodown or APKPure. Set a PIN and enrol your fingerprint, which arms the Keystore-backed vault.
Scan the service's standard otpauth:// QR code, or type the secret manually when a QR is unavailable — which is exactly how it should be, since the secret is then never photographed.
Codes compute on-device against the local clock. Airplane mode, a dead SIM and a locked-down network all change nothing.
Create an encrypted Panic Backup, print or store the Master QR, and test a restore on a second device before you ever need it.
| Time-step | 30-second TOTP windows per RFC 6238 |
|---|---|
| Secret storage | Android Keystore, encrypted at rest |
| Unlock | PIN or fingerprint (biometric via Keystore) |
| Duress path | Stealth Mode opens a decoy vault |
| Backup | Encrypted Master QR or .x2y file |
| Organising | Work, Finance, Social plus custom folders |
Who it is for
Six patterns where on-device TOTP is the correct architecture.
Email, banking and domain registrars, where the attacker's realistic path is a breached cloud backup — a thing this app cannot be part of.
Sources and accounts where a vendor-held vault is an attractive subpoena target. The vault lives on your device and nowhere else.
Separate Work, Finance and Social folders keep client credentials organised and easy to remove from at handover time.
Stealth Mode with a duress PIN and decoy accounts, so a forced unlock reveals only what you intended to show.
No account to disable remotely, no sync to suspend, and codes that keep working on a phone with the SIM removed.
WiFi Companion streams the current code to a browser on your LAN, so you are not squinting at a phone across a meeting table.
Prerequisites
| Requirement | Minimum | Recommended |
|---|---|---|
| Device | Android phone or tablet | A second Android device, so you can rehearse a restore |
| Installation | Allow installation from an unknown source for the sideload, then turn it back off | Prefer the signed GitHub release over a mirror |
| Hardware | PIN-capable device | Fingerprint or face unlock backed by the Android Keystore |
| Clock | Reasonably accurate system time | Enable optional NTP sync if the device drifts, then disable it again |
| Network | None for code generation | A local network only if you choose WiFi Companion |
| Permissions | Local storage for the encrypted vault | Grant nothing else — the core flow needs no network permission |
| Backup | An offline place for the Master QR or .x2y file | Print the QR and keep it physically separate from the phone |
Context
Both are usable. They fail in different ways, and you should pick knowingly.
| Property | x2y Authenticator | Synced authenticator app | SMS or app-push codes |
|---|---|---|---|
| Where secrets live | Your device, Keystore-encrypted | Vendor cloud, encrypted to a key the vendor's process can reach | The carrier or the sending service |
| Server-side breach impact | Nothing to breach | Depends entirely on the provider | SIM-swap risk sits with the carrier |
| Recovery | You hold the only backup | Provider account recovery flow | Carrier or service support desk |
| Offline behaviour | Works with the radio off | Usually cached, sync-dependent | Needs network or roaming |
| Duress protection | Decoy vault behind a duress PIN | Not offered | None |
| Cost | Free, no account | Free or subscription | Free to you, weak as a factor |
Questions
.x2y file, which you store the way you would store a hardware key..x2y file. If that backup is gone too, the services themselves must fall back to their own recovery codes, so keep those when you enrol anywhere. This is the price of a vault we cannot open for you.Documentation
Ready to go offline
No cloud. No sync. No account. Just a vault that answers to you alone — with Stealth Mode for when the stakes are highest.
| Version | v1.2.0 |
|---|---|
| Platform | Android |
| Price | Free |
| Telemetry | 0 bytes |