Simple, Local OTP Management

Features

• Add OTPs by scanning QR codes, clicking on otpauth:// links, or by manually typing in secrets.
• Copy OTP codes to your universal clipboard in-app
• View OTP codes using Widgets which can appear on your Home Screen or Notification Center, so you can use them without ever needing to open the app
• Support all TOTP standard configuration options (see HOTP RFC4226 and TOTP RFC6238 for details)
  • OTP codes of lengths between 6 and 8 digits
  • Three hash algorithms: SHA1 (default), SHA256, SHA512
  • Multiple time periods: 15s, 30s (default), 45s, 60s
• Stores all data inside your devices Keychain. If you have iCloud Keychain enabled, this means your OTPs will be synced with all your devices, and you wont lose any OTPs when you replace your device.
• 100% on-device processing and storage. OVault contains absolutely 0 connections to internet services, so your data isn't sent or stored anywhere except from your device (with the caveat of iCloud Keychain if enabled, as mentioned above)
• No telemetry or usage data is recorded by OVault
• Zero app lock-in: reveal your stored secrets within the app, allowing you to transfer your OTPs manually to another app at any time

Open Source

OVault is completely open source, you can view, contribute to, or fork the source at the projects GitHub repository.

OVault is built to be simple, so the project will never expand in scope beyond what it is today: an interface to store OTP secrets in your Keychain, and calculate TOTPs from it. Future plans include exposing your OTPs in more places (like through an Apple Watch app, or with better Widgets), but nothing will change the overall scope of the app.

Threat Model Considerations

OVault uses your devices Keychain, which may or may not be synced to external Apple servers depending on if you have iCloud Keychain enabled. If you use Keychain for storing your passwords, this also means that your passwords and potentially related OTP secrets will be stored in the same app and database (although not directly linked). Please be sure to consider this when designing your security practices around your anticipated threat models. This app isn't designed to be the most secure OTP app in the world.

About Me

I'm a solo hobbyist developer, and I released this app because the existing options (I used to use Authy) were (in my eyes) becoming overcomplicated and losing useful features (like Home Screen widgets). All I needed was a simple place to safely store and access my OTPs, and let me export them if I ever needed to - so I created it. Of course, learning how TOTP/HOTP codes actually work was a bonus.

Check out my other work at amandhoot.com