Frequently asked questions

We cannot do anything. Like, for real. Your TOTPs are encrypted using a key derived from your master password with the Argon2 algorithm. We will be unable to recover your data if you forget your master password. For this reason, you're strongly advised to do regular backups. The app automatically asks you to make a backup before sensitive operations, but you can manually create one in the app settings.

If you don't have enabled data synchronization, then everything is stored locally in a SQLite database managed using Drift. Even in this case, everything is encrypted. If you have enabled data synchronization, we use Firestore to store you data. If the app become popular, we plan to create our own backend.

As you may know, servers are not free. In our case, because we rely on Firebase, the more users we have, the more we have to pay. So, either we : 1. put ads in our app ; 2. rely exclusively on donations ; 3. ask our users to pay some money. Option 2. is not realistic at all. Option 1. could be a solution, but ads generally result in a bad user experience. Therefore, the choice we made to be able to be sustainable enough is to create a subscription based model called "Contributor Plan". Currently, you can store and synchronize up to six TOTPs for free, with all your devices. By subscribing to the Contributor Plan, you get unlimited TOTP synchronization. In the future, we hope to be able to raise these limitations, or even to remove them ! Anyway, you can totally use the app locally without any limitation nor any ad.

Yes, you should. If your password manager ever get compromised, then both your passwords and your TOTPs will be exposed. Therefore, the second authentication factor will not act as it should. Don't put all your eggs in one basket !

It is not enabled because both Firebase Auth and Firebase Firestore are currently unsupported on Linux. Your current option is to manually import all your TOTPs on Linux. You can also use the backup feature in the app to do so.

If you're in this case, it probably means that Open Authenticator has been installed via Flatpak. Local authentication on Linux relies on a Polkit policy file that must be present on your host under /usr/share/polkit-1/actions. If it's not present, you can install it by copying this file into /usr/share/polkit-1/actions. Then restart Open Authenticator (or your session).