- Home
- Authenticator apps
- SelfHostAuth
On the recordRead 9 Oct 202620 facts
SelfHostAuth
Plans and prices
SelfHostAuth
Free
Open source · self-hosted only · no hosted version
Read 9 Oct 2026 · github.com
On the record
- Audience
- The README identifies homelabbers, privacy advocates, teams needing a self-hosted OTP server, and people seeking alternatives to Google Authenticator or Authy as its intended users.github.com · read 9 Oct 2026
- Availability limit
- The project says there is no hosted version and it is self-hosted only by design.github.com · read 9 Oct 2026
- Clients
- The project lists a web vault, Windows/macOS/Linux Electron desktop apps, iOS and Android apps, and Chrome/Edge/Firefox browser extensions.github.com · read 9 Oct 2026
- Code standards
- It supports RFC 4226 and RFC 6238, SHA-1, SHA-256, and SHA-512, 6–8 digits, and configurable periods.github.com · read 9 Oct 2026
- Code type
- totp and hotpgithub.com · read 21 Sep 2026
- Deployment
- The server uses Node.js 22+ and SQLite and can run with Docker Compose, systemd, or bare metal on a home server, NAS, Raspberry Pi, or VPS.github.com · read 9 Oct 2026
- Imports
- Users can add accounts by scanning or pasting a QR code, an otpauth:// URI, or a raw base32 secret.github.com · read 9 Oct 2026
- Integrations
- It accepts otpauth:// imports and provides a typed TypeScript API client for its sync server.github.com · read 9 Oct 2026
- License
- The repository is licensed under MIT.github.com · read 9 Oct 2026
- Multi-device sync
- Yesgithub.com · read 21 Sep 2026
- Offline use
- Clients cache the vault locally and compute TOTP codes without connecting to the server.github.com · read 9 Oct 2026
- Purpose
- SelfHostAuth is an open-source, self-hosted TOTP/HOTP authenticator and sync server.github.com · read 9 Oct 2026
- Push approvals
- Nogithub.com · read 21 Sep 2026
- Security
- The server encrypts vault items at rest with AES-256-GCM, hashes passwords with scrypt and session tokens with SHA-256, and supports optional account TOTP authentication.github.com · read 9 Oct 2026
- Security disclosures
- The vulnerability report last checked on 2026-09-28 lists one high and one medium finding, including a pnpm audit summary of 24 vulnerabilities.github.com · read 9 Oct 2026
- Supported platforms
- web,windows,macos,linux,ios,android,chrome_extensiongithub.com · read 21 Sep 2026
- Support policy
- The security policy says maintainers aim to acknowledge vulnerability reports within three business days and ship a fix or mitigation within 30 days for high-severity issues.github.com · read 9 Oct 2026
- Sync
- Revision-based push/pull sync uses last-write-wins and tombstones so deleting a code on one device deletes it across devices.github.com · read 9 Oct 2026
