Lockbox
An offline TOTP/HOTP authenticator for iOS and Android
-
Pinned accounts first, each code counting down on its own ring — generated on the device, with nothing to sync.
Lockbox generates the same six- or eight-digit two-factor codes as Google Authenticator or Raivo OTP. The difference is what is absent: the app contains no networking layer at all. Nothing is uploaded, nothing is synced, and there is no backend to compromise.
Secrets live in the iOS Keychain. Accounts are cleared from memory when the app is backgrounded and re-prompted on return, so a shoulder-surfed app switcher gives nothing away.
Features
- TOTP (RFC 6238) and HOTP (RFC 4226) with SHA-1, SHA-256, and SHA-512.
- 6 or 8 digit codes, 30- or 60-second periods.
- Add accounts by scanning an
otpauth://QR code, or by entering a Base32 secret by hand. - Face ID / Touch ID lock with device-passcode fallback.
- Pinned and recently used sections, plus search.
- Tap a code to copy — the clipboard entry is marked local-only and expires after 30 seconds.
- Import and export in Raivo OTP's JSON format, so it is not a one-way door.
Honest about the limits
This app has not been independently security audited. It ships a SECURITY.md that documents the storage design, the known limitations, and how to report a vulnerability — and both the README and the repo description say the audit gap out loud, because an authenticator that oversells itself is worse than one that doesn't exist.
The test suite covers the RFC 6238 and RFC 4226 reference vectors, otpauth:// URI parsing, and Raivo import/export round-tripping. It runs on macOS through the Swift Package manifest with no simulator needed, which keeps the fast path fast.
On Android
The same app exists for Android, written in Kotlin with the interface in Jetpack Compose. The rule that defines it did not get relaxed in the port: still no networking layer, still nothing to sync, and secrets held by the platform’s own secure storage rather than a file the app manages itself — the Keychain on iOS, the system keystore on Android.
Stack
| Language | Swift 6, strict concurrency checking set to complete |
|---|---|
| UI | SwiftUI, iOS 17+ |
| Android | Kotlin and Jetpack Compose, with secrets in the system keystore |
| Storage | Keychain |
| Crypto | SwiftOTP and Apple's swift-crypto, via Swift Package Manager — nothing vendored |
| Project | XcodeGen; project.yml is the source of truth and the .xcodeproj is not checked in |