Tokn

A small, opinionated 2FA / MFA authenticator for Android. Your one-time codes stay on the device, encrypted. No sign-up, no sync server, no analytics.

Website: usetokn.app - feature tour, app comparisons, and step-by-step migration guides. For the cryptography, key handling, and threat model, see: https://github.com/tokn-authenticator/tokn/blob/main/SECURITY.md

Why Tokn?

- It minds its own business. No account, no telemetry, no Google Play Services on your device. - Encrypted by default. The local vault is stored in an SQLCipher database, with your password run through Argon2id before it ever touches the key. Unlock it with a password, biometrics, or both; each method unlocks the same vault independently, so losing one does not lock you out of the others. - Hide on demand. Optional screenshot protection keeps codes out of the recents preview and blocks screen capture. - Keeps an audit log. Vault unlocks, settings changes, account and backup activity all get a timestamped entry, filterable by category, search, or date. Configurable. - Optional recycle bin. Deleted accounts can be kept for 30 days. - Standards based. TOTP and HOTP per RFC 6238 and RFC 4226, with SHA-1, SHA-256 and SHA-512. Compatible with Google Authenticator URIs. - Adding a code is quick. Scan a QR code with the camera, pick a QR image from the gallery, or type the secret in by hand. - Move between phones without a server. Encrypted device-to-device sync over QR codes, the local Wi-Fi network, or Wi-Fi Direct. The handshake is end-to-end encrypted and nothing leaves the local network. - Bring it with you. Encrypted backup and restore (also Argon2id based) for migrating or just feeling safer. Backups from older versions still restore. - Organize the vault. Group accounts (multiple groups per account if you like) and sort the list the way you want. - Pleasant to look at. Material 3 Expressive, built with Jetpack Compose.

Switching from another app

Tokn reads backups from Aegis, 2FAS and Stratum directly, scans Google Authenticator's export QR codes, and accepts plain otpauth:// URI lists. Step-by-step guides for each app live on the website: Aegis, Google Authenticator, 2FAS, Stratum, Authy and Microsoft Authenticator.

Icon packs

Accounts can use a custom PNG you pick from your gallery, or an icon from an imported pack. Packs are .zip files containing a pack.json manifest plus the icon images. Import them from Settings > Appearance > Icon packs.

Tokn uses the same pack format as Aegis, so existing Aegis icon packs work without conversion. A good ready-made source is aegis-icons.

License

GNU General Public License v3.0 or later