iCloud sync
Off until you turn it on. Every entry is encrypted with AES-256-GCM before it goes to iCloud, and the key is in your iCloud Keychain: Apple can’t read your codes, and neither can we. Your iPhone, iPad and Mac then have the same accounts.
The authenticator app for iPhone, iPad and Mac. Your second key. Kept by you.
FairAuth creates the one-time codes for two-factor authentication (2FA) at Google, Microsoft, Amazon and every other service that works with an authenticator app. Your codes are encrypted on your device, you don’t need an account, and you decide where your backup goes.
Try everything free for 7 days, then buy once. No subscription.
Move from Google Authenticator, Authy, 2FAS and 6 more apps →
FairAuth DemoDemo account, no real serviceLive demo
Next
A real code, calculated right now in your browser. Nothing is sent anywhere. How is this code made?
Chapter 1: Why it matters
A password is one key. The code is the second.
With two-factor authentication, a service asks for a short code on top of your password. A stolen password alone is then no longer enough to get in. So the app that holds these codes guards the most important keys you have online. It should protect them well and ask for nothing in return.
- No account, no email address, no phone number
- No servers of ours: your codes stay on your devices
- No subscription: 7 days free, then a one-time purchase
Chapter 2: How a code is made
Six digits from a secret and the time.
When you turn on two-factor authentication, the service shows you a QR code. It holds a secret that only your device and the service know. From then on, both calculate the same code from that secret and the current time, a new one every 30 seconds, as the open standard RFC 6238 describes. No connection is needed, which is why FairAuth works offline. The code on this page is calculated live in your browser, from a demo secret.
The secret
It’s inside the QR code, written in Base32. In FairAuth it stays in the encrypted vault.
MZQW S4TB OV2G QLLE MVWW 6LLT MVRX EZLUThe time
Seconds since 1 January 1970, divided by 30. Every device with the right time gets the same number.
…The mix
HMAC-SHA1 mixes the secret and that number into 20 bytes. The last character decides where to read on.
…The code
Four bytes from there make a number. Its last six digits are your code.
…
FairAuth DemoDemo account, no real serviceLive demo
Next
In FairAuth, the line under each code runs empty the same way and turns orange in the last five seconds. In the last ten, the next code already shows beside it.
What if your clock is wrong?
Move the slider to put the clock of your device off. The service always calculates with the correct time.
Your device shows••• •••
The service expects••• •••
Check it yourself
Scan this QR code with FairAuth or any other authenticator app. It shows the same code as this page, because both follow the same standard. It’s a demo account for no real service, so delete it afterwards.
Chapter 3: Moving in
Bring your accounts. Leave your old app.
FairAuth reads the export files of other authenticator apps and password managers, the transfer QR codes of Google Authenticator and an export from Apple Passwords. For Authy, it writes the data request for you. Everything is read on your device, nothing is uploaded, and you see what was found before anything is added. If your old app has no export, a checklist takes you through it account by account and remembers which ones you have already moved.
- Google Authenticator
- Authy
- 2FAS
- Aegis
- Ente Auth
- Bitwarden
- Proton Authenticator
- LastPass Authenticator
- Apple Passwords
A new account takes seconds: scan the QR code, choose a screenshot, open the setup link or type in the key. On the Mac, FairAuth reads the QR code straight from the screen, without asking for permanent screen recording access.
Chapter 4: Protection
Sealed in the chip of your own device.
Your codes are encrypted on your device. The key to them is locked once more, by a key in the Secure Enclave: the sealed security area in your device’s chip. That key never leaves the chip and can’t be copied to another device. Only Face ID, Touch ID or your device passcode release it, and the system checks them, not FairAuth.
AES-256-GCM
Each entry is encrypted on its own and bound to its place in the vault, so no entry can be swapped or moved unnoticed.
Secure Enclave
The vault key is wrapped with HPKE (RFC 9180) for a P-256 key in the Secure Enclave. From iOS 26 and macOS 26 on, ML-KEM-768 is added, a method designed to withstand quantum computers.
Only you open it
Face ID, Touch ID or the device passcode; on the Mac, Touch ID or your login password. FairAuth locks again after the time you choose. On the Mac it also locks on sleep, when the screen locks and when you switch users.
Out of sight
On iPhone and iPad, the codes are covered in the app switcher and during screen recording. On the Mac, the FairAuth window doesn’t appear in screenshots, recordings or screen sharing. A copied code stays on this device and leaves the clipboard when it expires, after 60 seconds at most.
Not in device backups
The vault stays out of iCloud backups of your device and out of Time Machine, because its key could never come along. FairAuth has its own backups for that.
Nothing to send
No servers of ours, no analytics, no ads. The only outside code is the encryption library libsodium. The Mac app doesn’t even have permission to open network connections.
Where every app reaches its limit
- A device that is itself compromised, for example jailbroken: whatever FairAuth shows while unlocked, an attacker in the system sees too.
- Someone with your device passcode and your Apple Account could get the key for iCloud sync. That is the limit of Apple’s end-to-end encryption.
- A weak backup password. FairAuth suggests six random words and only accepts a password of your own if it is long enough and hard to guess.
- A camera pointed at your screen. For that, you can hide codes until you tap them.
Chapter 5: Backups
Lose your phone. Keep your accounts.
Without a backup, a lost iPhone means setting up every account again. FairAuth gives you two ways, and you can use both. Everything is encrypted before it leaves your device, and both stay free forever. And if you delete an account by mistake, it stays in Recently Deleted for 30 days.
Backup file
Saved a few seconds after every change, in a folder you choose: a USB drive, your NAS or your own cloud storage. FairAuth reads each file back to check it. Protected by your backup password with Argon2id (256 MiB of memory per attempt) and XChaCha20-Poly1305. The last five versions are kept.
Open format
The file format is published, so your backups open even without FairAuth. And you can export your accounts as setup links or JSON at any time, after Face ID or Touch ID.
Chapter 6: On the Mac
A real Mac app. Not a phone app in a window.
Your codes are in the menu bar: search, click, copied. FairAuth reads QR codes straight from the screen and fills in codes in Safari and in apps, with the extension also in Chrome and Firefox. Keyboard shortcuts cover what you do often. One purchase covers Mac, iPhone and iPad.
Needs a Mac with Apple silicon and macOS 15 or later.
In Chrome and Firefox too
On your Mac, the FairAuth extension fills in the code with one click: only on the website saved with the account, and only after Touch ID or your login password. Nothing leaves your Mac.
Needs FairAuth for Mac 1.2 or later.
For your browser
Other Browsers
- Firefox Add-onsAdd to Firefox
- SafariSafari needs no extension: FairAuth fills in codes there with AutoFill.
Chapter 7: Honestly
What FairAuth does. And what it doesn’t.
It does
- Time-based (TOTP) and counter-based (HOTP) codes, and Steam Guard
- SHA-1, SHA-256 and SHA-512, 6 to 8 digits, 10 to 120 seconds
- AutoFill in Safari and in apps, plus Chrome and Firefox on the Mac
- More than 3,200 logos, built in and searched on your device
- Works without internet, in 24 languages, with VoiceOver and large text
- Folders, tags and favorites, Siri and Shortcuts, and Control Center buttons to scan a QR code
It doesn’t
- No passwords and no passkeys: FairAuth is an authenticator, not a password manager
- No sign-in requests to confirm with a tap. Services that only offer those need their own app
- No codes on the Lock Screen or in widgets, on purpose: nobody should see them there
- No Android, no Windows, no Mac with an Intel processor
- We can’t restore your accounts. Without iCloud sync or a backup file, a lost device means using each service’s backup codes
Chapter 8: Five promises
Our Promises
Five promises that hold for every version of FairAuth, and how we keep them.
No account, no phone number.
FairAuth works without signing up. There is no FairAuth account that could be lost, locked or hacked.
You decide whether to use the cloud.
Nothing leaves your device unless you turn on iCloud Sync. The backup file goes to the place you choose, and you can change it at any time.
No data collection, no tracking, no ads.
The app contains no analytics, no tracking and no advertising. It only connects to Apple for iCloud Sync and purchases.
Your codes belong to you: export anytime in an open format, with no lock-in.
Export an unencrypted list of your accounts at any time, or use the backup file: its format is published and can be opened with free tools, without FairAuth.
Your codes and backups are never behind a paywall.
Viewing and copying codes, both backups, restoring and exporting always work, with or without a purchase.
Chapter 9: Price
Try everything for 7 days. Then pay once.
During the trial, everything works. Afterwards you keep everything you have: your codes, your backups and your export stay free forever.
No subscription. The trial ends by itself, nothing is charged automatically.
Full Version
One-time purchase, no subscription
$8.99
App Store price (United States). It may differ in other countries.
| Free | Full Version | |
|---|---|---|
| Showing and copying all your codes | Yes | Yes |
| Backup file and iCloud Sync | Yes | Yes |
| Export in an open format | Yes | Yes |
| Restoring from any backup | Yes | Yes |
| Adding new accounts, also by import from another app | No | Yes |
| Your own images for accounts | No | Yes |
| Filling in codes with AutoFill | No | Yes |
| Shortcuts and widgets | No | Yes |
How are my codes protected?
Your codes are stored encrypted on your device (AES-256). The key is protected by the Secure Enclave, a sealed-off security area in your device’s chip. It can only be used after Face ID, Touch ID or your device passcode.
FairAuth never sees your biometric data; the system checks it.
Which servers does FairAuth connect to?
Only Apple’s: iCloud if you turn on sync, and the App Store for purchases. FairAuth has no servers of its own.
On the Mac, FairAuth doesn’t even have permission to open network connections of its own.
I lost my iPhone. What now?
First of all: your codes are safe. FairAuth only opens with Face ID, Touch ID or your device passcode.
How to get back to your accounts:
- With iCloud sync or a backup file: install FairAuth on the new device and restore from it.
- Without a backup: sign in with the backup codes of each service or use its account recovery, then set up two-factor authentication again.
Can I take my accounts elsewhere at any time?
Yes, free and at any time, under Export Your Accounts. You have three options:
- an encrypted backup file
- a list of setup links (otpauth), which many authenticator apps read
- a complete list in JSON format
You get the two unprotected lists only after Face ID and with a warning, so they don’t end up in the wrong hands by accident.
What happens to my codes if FairAuth stops existing?
Your codes keep working. They’re on your devices, not with us, and the app needs no server of ours.
You can also export your accounts at any time, and because the backup file format is published, it can be opened even without FairAuth.
How safe is iCloud sync?
Your codes are encrypted on your device before they go to iCloud. The key for this is in your iCloud Keychain, which Apple itself can’t read. So only your own devices can read your codes: not Apple, and not us.
A code isn’t accepted. What can I do?
- Check your device’s time. Codes depend on the exact time; even one minute off makes them invalid. Turn on Set Automatically: on the iPhone under Settings > General > Date & Time, on the Mac under System Settings > General > Date & Time.
- If the line below the code is almost empty, wait for the next code.
- If neither helps, set up the authenticator app again at the service with a new QR code.
Do I have to buy FairAuth separately for Mac and iPhone?
No. One purchase covers iPhone, iPad and Mac as long as you use the same Apple Account. After reinstalling, tap Restore Purchases and the full version is back.
Your accounts. Your keys.
Set up in a minute, everything to try for 7 days. And even if you never buy, your codes keep working and your backups stay free.
Try everything free for 7 days, then buy once. No subscription.