July 2026 — the entire x2y suite is now free. Code Leak Detector moves to a one-time $29 on 1 Sep.
View productsOffline 2FA Vault for Android
Offline by choice. Secure by design. A high-security offline 2FA vault with Stealth Mode, encrypted Panic Backups, and WiFi Companion for seamless desktop access.
Free — no account, no cloud sync, no telemetry. Your secrets never leave your device.
Security features
TOTP codes are computed entirely on-device using locally stored secrets and the system clock. The application has no network permissions and makes zero outbound connections. Airplane mode is the recommended operating environment.
Configure a secondary PIN that opens a decoy vault populated with fake accounts. Under coercion, hand over the duress PIN — your real secrets remain invisible and inaccessible. The attacker sees a convincing but worthless vault.
Export your entire vault as an encrypted backup protected by a master recovery key rendered as a QR code. Store the QR physically — in a safe, with a lawyer, split between trusted parties. Restore from it on any device running x2y Authenticator.
Unlock the vault with a numeric PIN, fingerprint, or both. Biometric data never leaves the Android Keystore — x2y Authenticator only receives a yes/no authorisation result from the hardware-backed secure enclave.
Convenience features
Need a code on your desktop? The WiFi Companion securely streams TOTP codes from your phone to a PC browser over your local network. No cloud relay, no internet hop — the connection stays within your LAN and uses end-to-end encryption.
Organise accounts into colour-coded categories. Switch between Work, Finance, Social and custom folders instantly. Each folder can have its own lock timeout and visibility rules.
Two recovery paths: scan the Master QR code generated during Panic Backup setup, or import an encrypted .x2y backup file. Both methods restore the full vault with all accounts, folders and settings intact.
TOTP codes depend on accurate time. x2y Authenticator optionally syncs against NTP servers to correct clock drift — the sync fetches only a timestamp, no personal data is transmitted, and it can be disabled entirely for air-gapped use.
Specifications
| Product | x2y Authenticator |
|---|---|
| Version | v1.0.0 |
| Platform | Android |
| Protocol | TOTP (RFC 6238) |
| Storage | On-device encrypted vault (Android Keystore) |
| Sync | None by design — no cloud, no server |
| Authentication | PIN + Biometric (fingerprint via Android Keystore) |
| Stealth Mode | Duress PIN opens decoy vault with fake accounts |
| Backup | Encrypted Panic Backup via Master QR or .x2y file |
| Import | Manual secret entry, otpauth QR scan |
| WiFi Companion | LAN-only encrypted stream to PC browser |
| Folders | Work, Finance, Social + custom categories |
| Time sync | Optional NTP (timestamp only, disableable) |
| Network permissions | None required for core operation |
| Telemetry | 0 bytes — verified continuously |
| Account required | None — ever |
| Price | Free |
| Developer | x2y Devs Tools Ltd, Nairobi, Kenya |
Quick start
Download from GitHub Releases, Uptodown or APKPure. Enable installation from unknown sources if prompted. Verify the SHA-256 checksum before installing.
Create a vault PIN on first launch. Optionally enable fingerprint unlock. Configure a separate duress PIN for Stealth Mode if desired.
Scan an otpauth QR code from any service's 2FA setup page, or enter the secret manually. Assign each account to a Smart Folder (Work, Finance, Social).
Generate your encrypted Master QR recovery key. Store it physically — safe deposit box, sealed envelope, split between trusted parties. This is your lifeline if the device is lost.
Downloads
Changelog
Initial release. Offline TOTP vault with PIN and biometric authentication. Stealth Mode with duress PIN and decoy vault. Encrypted Panic Backup via Master QR and .x2y file. Smart Folders (Work, Finance, Social). WiFi Companion for LAN-only code streaming to PC browsers. NTP time sync (optional, timestamp only). Zero network permissions for core operation.
Security model
x2y Authenticator was designed around a single threat model: your secrets are safest when they exist in exactly one physical location that you control. There is no cloud copy to breach, no sync server to subpoena, no analytics pipeline to leak through. The WiFi Companion is the only feature that uses the network, and it operates exclusively within your local area network with end-to-end encryption — no packets leave your router.
| Telemetry | 0 bytes collected |
|---|---|
| Account | None required — ever |
| Cloud sync | None — by design |
| Secret storage | Android Keystore (hardware-backed) |
| Network perms | None for core operation |
| WiFi Companion | LAN-only, end-to-end encrypted |
| Backup | Encrypted locally, never transmitted |
| Duress protection | Stealth Mode with decoy vault |
Ready to go offline
No cloud. No sync. No account. Just a vault that answers to you alone — with Stealth Mode for when the stakes are highest.
| Version | v1.0.0 |
|---|---|
| Platform | Android |
| Price | Free |
| Telemetry | 0 bytes |
