I came across a blog post by Imran Nazar titled Degoogling TOTP Authenticator Codes (via Hacker News page one). In the post, Mr. Nazar, who explains that he spends most of his computer time “in a terminal window on MacOS or connected to a Linux machine,” sought a solution that would allow him to decrease his dependence on the proprietary Google Authenticator TOTP phone app and access his TOTP codes through the command line using a utility called oathtool. Mr. Nazar describes his new TOTP workflow in detail for those who are interested. I decided to construe the post as an invitation to describe my own TOTP workflow – which is powered by Aegis Authenticator, Authenticator (for Linux), and Syncthing.
Before continuing, this post presupposes some general familiarity with second-factor TOTP codes. If this subject is new to you, I encourage you to read a short introduction by Twillio.
My TOTP History
I am a proponent of degoogling. However, unlike Mr. Nazar and many others, my TOTP codes were never Google’d. This is not to say that I was always privacy conscious and inclined toward local, open source solutions to my tech problems. I think there is a good chance I would have been on Google Authenticator or a similar cloud-based proprietary solution had my phone history been different.
I had used feature phones from roughly 2003-2013. In 2013, I began using my Mom’s former BlackBerry Bold. When that died in 2016 or so, I switched to a refurbished BlackBerry Classic, which ran the Android-adjacent BlackBerry 10. I used the BlackBerry Classic through March or April or 2021, when I switched to my first real Android phone (beginning in September 2021, my phones have run, in order, Android-based /e/ OS, LineageOS, and now GrapheneOS).
I did not even use a password manager until somewhere in the neighborhood of 2018 (sadly LastPass before I knew better and switched to Bitwarden in 2020, followed by a subsequent move to KeePass XC, which I use today). It should go without saying that I was not familiar with TOTP codes. I recall having learned about how they worked in 2020. At that point, I still had my legacy BlackBerry Classic and was very late to learning that it could run some regular Android apps from F-Droid, so I decided to get a cheap Android tablet (Vankyo MatrixPad S7) to set up a 2FA app.
After some cursory research, I installed the free and open source F-Droid app store and downloaded the similarly free and open source Aegis Authenticator to generate and manage my 2FA codes. My current Aegis Authenticator database in 2025 has a direct lineage to the one I started back in October or November of 2020.
My Authenticator Workflow
One of the first things I do when I obtain a new phone or start fresh on an existing phone is install Aegis Authenticator. As I noted, Aegis Authenticator is, as described on its website, “a free, secure and open source app for Android to manage your 2-step verification tokens for your online services.” It supports both TOTP and HOTP. Unlike some cloud-based TOTP solutions, Aegis stores data encrypted on device. It can generate TOTP codes through the device camera and manage them. Aegis makes it easy to export the database or import an existing database. Its backup behavior can also be controlled through the settings (I configured it to store five backups).
(Aegis Authenticator is free to download and use. It is available on Google Play Store, F-Droid, and GitHub. I installed it from F-Droid, but I did briefly install directly from GitHub.)
Aegis Authenticator works perfectly as an on-device 2FA tool. It is easy to generate new tokens and to find them. However, because Aegis Authenticator is local only, it puts the onus on the user to be responsible with backups. It would be unwise, to put it mildly, to have a database of TOTP tokens on a single device without backing them up. Were the device to break or be stolen, one would lose all of his or her TOTP tokens (the Aegis database is encrypted, so that would presumably keep the tokens themselves from being stolen provided that the phone thief did not have the master password).
My primary solution to the one-device problem is Syncthing. Syncthing, which is my most valuable app, syncs directories between devices without a central server. It is readily available for the three major computer operating systems and Android (it is not officially available for iOS but I understand there are some partially compatible solutions). I sync the directory containing my Aegis database and backups between my phone and various computers and other devices. This ensures that Aegis is not locked to a single device.
Before continuing, note that Syncthing comes with certain caveats – especially when relying on it for something important like ensuring you do not lose access to tens of TOTP codes. By default, Syncthing syncs bidirectionally, meaning changes on one device are reflected on all devices. This makes it not entirely amenable to backup usage, albeit bidirectional syncing can be configured on a per-device basis. Having Aegis open on multiple synced devices simultaneously and making changes on one would likely cause issues with the synced database, albeit I cannot imagine why one would do that. In any event, I have two recommendations for using Syncthing to sync anything password related (note I use the same method with my KeePassXC password database).
- Firstly, it is important to understand how Syncthing actually works and what it does well and what it does not do. Using Syncthing without understanding what it does on a practical level is a recipe for problems.
- Secondly, I would recommend keeping at least one set of database backups separate from Syncthing. For example, we could imagine some terrible scenario where some sort of virus or nefarious actor deletes or moves the contents of the synced Aegis backups directory on one device, which then syncs the changes to other devices, thus emptying the folder. This may not be likely (it is not something I am worried about in my own use-case), but when we are dealing with important log-in credentials, it is good to consider and hedge against disaster scenarios.
Do note before continuing that Syncthing is certainly not the only solution. Cloud storage solutions such as Dropbox, Google Drive, or a local home server could be used to similar effect (with their own caveats), and the fact the Aegis database is encrypted hedges against potential privacy concerns. Dedicated backup solutions such as Backblaze, Wasabi, or Borg Backup can also help protect against data loss, including in conjunction with Syncthing or one of the more popular cloud storage/collaboration solutions. But this article is about my method, and my method is Syncthing-first.
I generate all of my TOTP codes on my phone with Aegis Authenticator. However, like Mr. Nazar, I prefer accessing the codes on my computer. In fact, I cannot remember the last time I actually used a TOTP code on my phone. For that reason, I also prefer being able to access and use the codes on my computer, although through a GUI instead of a CLI tool. Fortunately for me, Linux has the perfect app for this. I use Bilal Elmoussaou’s Authenticator app (see source code and Flathub page).
Authenticator, like Aegis, makes it easy to search websites to find a TOTP code in the TOTP database. Most significantly for my purpose, it comes with an option to import encrypted databases from Aegis Authenticator. Thus, we have the following work-flow:
- Create TOTP passwords in Aegis Authenticator
- Sync most recent five versions of my Aegis Authenticator database across devices
- Import most recent version of database into Authenticator app on Linux
- Use Authenticator app on Linux whenever I need one of my TOTP codes
As a rule, I never make changes to the database in Authenticator. I treat Aegis on my phone as the source of authority and simply update Authenticator on Linux with the newest version of the database whenever I add or remove website entries.
My Aegis/Linux Authenticator set-up works perfectly for me. It is not only degoogled, it does not require my data to be stored on third party servers (unless I affirmatively decide to back it up to one). Whenever I need my TOTP codes on a new device, all I need to do is sync the directory containing the codes to that device. Because I have a definite workflow and understand how Syncthing works on a practical level, I am happy to report that I have avoided any Syncthing-related accidents or mishaps with my workflow.
Conclusion
My method, like Mr. Nazar’s, is just one way or doing things. As a general matter, I would strongly encourage anyone who uses Android or Android-based (e.g., Fire OS, LineageOS, GrapheneOS) and are looking for a stand-alone TOTP app to consider Aegis Authenticator. Assuming arguendo you opt for Aegis or a similarly local solution, Syncthing is a good way to ensure the database is available on multiple devices, albeit Syncthing comes with certain caveats and it makes the most sense in this use context for people who are already using it. As I noted, cloud-based sync solutions and backup tools are also viable depending on one’s workflow.
My specific method will obviously not work for everyone. Aegis Authenticator is Android-only, so it is not an option for iPhone/iPad users (I am sure there are some comparable open source solutions on the iOS side, but I have never had an iOS device so I am not competent to offer recommendations). My computer TOTP app of choice is Linux-only, so it is generally not an option for Windows and MacOS users. Some people may prefer a cloud-based TOTP solution, which off-loads some of the responsibility for backups and may ameliorate cross-device issues. Similarly, some may prefer to rely on their password manager to also handle TOTP codes (that is not my preferred method but it is a method). I do not claim that my way is the best way for everyone. For example, while I use KeePassXC as my password manager (note that KPXC can also handle TOTP for those looking for an integrated solution), I think that Bitwarden is probably a better option for most people who have some interest in privacy but want to off-load some of the responsibility for ensuring that their passwords are backed up.
I conclude by thanking Mr. Nazar for publishing his very interesting TOTP workflow, not least because it inspired me to throw my own TOTP hat into the ring.
