Open-source 2FA token manager with AES-256 encryption and OS keychain integration. No cloud accounts. No tracking.
Features
Every secret encrypted at rest with AES-256-GCM. Keys live in your OS keychain — never on disk in plaintext.
Sync via a folder you choose. New backups use Argon2id password derivation and authenticated encryption.
Built with Tauri and Rust for macOS, Windows, and Linux. Package size varies by platform.
Encryption keys stored in macOS Keychain, Windows Credential Manager, or Linux Secret Service.
MIT licensed. No telemetry, no analytics, no accounts. Audit every line of code yourself.
Password-encrypted backups. Migrate from other authenticators. You're never locked in.
Security
TOTP secrets are encrypted at rest and sync files are encrypted before they reach your chosen folder. Yhtua has no hosted account service, but it cannot protect against malware running as your OS user.
AES-256-GCM
Authenticated encryption for all stored secrets
Argon2id · 64 MiB · 3 passes
Memory-hard password derivation for new backup files
Rust cryptography
ring AES-GCM and RustCrypto Argon2id — no browser crypto APIs
Offline application logic
No analytics or telemetry; cloud-folder clients operate independently of Yhtua.
const ARGON2_MEMORY_KIB: u32 = 64 * 1024; const ARGON2_ITERATIONS: u32 = 3; const PASSWORD_AAD: &[u8] = b"yhtua-password-backup-v2"; // Derive a fresh key, then authenticate format + ciphertext. let key = derive_argon2id_key(password, &salt)?; let ciphertext = seal( plaintext, key.as_ref(), nonce, PASSWORD_AAD, )?;
Keep your 2FA secrets safe, private, and always within reach — on your terms.
Download Yhtua 2.8.2