- Home
- Authenticator apps
- OTPClient
On the recordRead 12 Oct 202617 facts
OTPClient
Plans and prices
OTPClient
Free
GPLv3; available as Flatpak, in distro repositories, and from source
Read 12 Oct 2026 · github.com
On the record
- Availability and license
- The project says OTPClient is available as a Flatpak and in several distribution repositories, and that it is released under GPLv3.github.com · read 12 Oct 2026
- Backup
- Token backups are byte-for-byte copies of the encrypted database written with 0600 permissions, and restoring opens the backup as an additional database without overwriting the active one.github.com · read 12 Oct 2026
- Code type
- totp and hotpgithub.com · read 22 Sep 2026
- Command line
- The CLI can list or show tokens, select databases, import or export data, and produce table, JSON, or CSV output for supported commands.github.com · read 12 Oct 2026
- Desktop integrations
- Its desktop search provider integrates with GNOME Shell Activities Search and KDE Plasma 6 KRunner, and the CLI includes Bash, zsh, and fish completions.github.com · read 12 Oct 2026
- Encrypted backup
- Yesgithub.com · read 22 Sep 2026
- Import and export
- It supports migration with Aegis, AuthenticatorPro, 2FAS, FreeOTPPlus, and Google migration QR codes (import only).github.com · read 12 Oct 2026
- Local encryption
- The local database uses AES-256-GCM encryption with a password-derived Argon2id key; the documented defaults are 4 iterations, 128 MiB memory, and parallelism 4.github.com · read 12 Oct 2026
- Maker
- The GitHub repository is owned by Paolo Stivanin, whose profile lists Italy and SUSE.github.com · read 12 Oct 2026
- Memory protection
- The project says decrypted token data and secrets are held in locked libgcrypt secure memory and wiped from memory when the database is locked.github.com · read 12 Oct 2026
- OTP support
- It supports TOTP, HOTP, Steam Guard codes, SHA1/SHA256/SHA512, and manual or otpauth URI token entry with 4–10 digits and 1–120 second periods.github.com · read 12 Oct 2026
- Purpose
- OTPClient is a GTK4/libadwaita application for managing TOTP and HOTP two-factor authentication tokens, with CLI and desktop-search integration.github.com · read 12 Oct 2026
- Security limits
- The security policy says a same-UID attacker with ptrace or /proc/PID/mem access can read secrets while the database is unlocked, and cold-boot or DMA attacks can recover secrets from RAM on an unlocked machine.github.com · read 12 Oct 2026
- Security support
- The security policy lists version 5.1.x as Active, 5.0.x as Maintenance, and versions below 5.0 as End of life.github.com · read 12 Oct 2026
- Supported platforms
- Linux desktopgithub.com · read 22 Sep 2026
- Token entry
- Tokens can be added by scanning a QR code from an image, webcam, or clipboard, or by entering the secret manually.github.com · read 12 Oct 2026
- Vulnerability reporting
- The security policy asks researchers to report vulnerabilities by email rather than opening a public issue, and says acknowledgment is within 24 hours and a fix will be developed and released within 7 days.github.com · read 12 Oct 2026
