Open Arsenal

Your Keys. Your Devices. Fully Protected.

E2EAuth is an open-source, cross-platform authenticator designed to provide secure, private, and convenient two-factor authentication across desktop and mobile devices. Supporting both Time-Based One-Time Passwords (TOTP) and HMAC-Based One-Time Passwords (HOTP), E2EAuth enables users to manage authentication credentials for their online accounts through a unified application. Features include QR code scanning, manual credential entry, account organization, searchable credentials, favorites, clipboard management, and offline authentication code generation. With support planned for Windows, macOS, Linux, Android, and iOS, E2EAuth aims to deliver a consistent authentication experience across the devices people use every day.

Built around end-to-end encryption and a local-first architecture, E2EAuth is designed to keep authentication secrets under the user’s control. Credentials are encrypted before synchronization, while protected local storage helps safeguard sensitive information on individual devices. Users can synchronize their encrypted vault between authorized computers and mobile devices through supported peer-to-peer connections, encrypted cloud services, or self-hosted infrastructure. Device pairing, authenticated key exchange, synchronization integrity checks, conflict resolution, and device revocation help protect the vault as it moves between environments. Users can also create encrypted backups, restore credentials on replacement devices, and manage application access through master passwords and supported biometric unlocking.

E2EAuth incorporates threshold-based social recovery to address one of the most challenging problems in encrypted applications: regaining access when all trusted devices are unavailable. Users can designate trusted recovery contacts and establish a recovery threshold that requires a predefined number of valid recovery shares to authorize restoration. Individual contacts do not receive ordinary access to the vault or its authentication codes. Authenticated recovery requests, explicit participant approvals, recovery-share management, security notifications, and post-recovery key management help establish a controlled restoration process. This approach reduces dependence on a single recovery device or individual while preserving the principle that synchronization servers and service administrators must not be able to independently decrypt the vault.

Designed for transparency, interoperability, and long-term user ownership, E2EAuth emphasizes publicly auditable security logic, documented protocols, automated testing, and responsible vulnerability disclosure. Its proposed architecture uses Flutter for mobile applications, Tauri and Rust for desktop applications, established cryptographic libraries, protected platform key storage, and standardized TOTP and HOTP implementations. Optional extensions can provide browser integration, command-line tools, hardware-backed security, advanced security policies, and additional synchronization capabilities. By combining open-source development, end-to-end encryption, cross-device access, and social recovery, E2EAuth aims to give users a dependable authenticator that prioritizes privacy, resilience, and control over their digital identities.

This specification is released under the AGPL-3.0+ and is free to use with required Section 7 attribution. Organizations seeking attribution-free deployment may obtain a Specification Branding License, with fees based on use and deployment scope.