How I Built a Zero-Knowledge 2FA Authenticator Using Rust, Tauri, and React

Hassan Magdy — Sun, 23 Aug 2026 20:24:04 +0000

Are you tired of being locked out of your accounts when you reset your phone? I was. I wanted a 2FA authenticator that would sync my codes seamlessly across devices, but I didn't want to hand over my plaintext secrets to a closed-source cloud provider.

So, I built OtpVault — an open-source, truly zero-knowledge 2FA application.

In this post, I want to share the architecture, the tech stack, and how I approached the security model.

🛠️ The Tech Stack
To make this work across Desktop (Windows), Android, and the Web (PWA), I needed a flexible yet highly secure stack:

Backend / Core Logic: Rust (Using aes-gcm, argon2, and totp-rs). Rust ensures memory safety and handles the heavy cryptographic lifting.

Desktop & Android Framework: Tauri v2. It allows wrapping the Rust backend with a web frontend natively and beautifully.

Frontend: React 19 + Vite + Tailwind CSS.

Cloud API: Neon PostgreSQL via Vercel Serverless.

🔒 The Zero-Knowledge Architecture
The core philosophy of OtpVault is simple: The server must never see the plaintext data.

Here is how the email-based authentication flow works:

Local Key Derivation: When you sign up or log in, your password and a randomly generated 32-byte salt are fed into Argon2id strictly on the client side (in Rust). This generates a strong 256-bit AES key.

Vault Encryption: Your entire vault of 2FA secrets is encrypted locally using AES-256-GCM.

Cloud Sync: The application sends a POST request to the Supabase/Neon REST API. The payload only contains your email, the salt, a test payload (to verify passwords later), and the opaque encrypted vault blob.

If the database is ever breached, the attacker gets nothing but meaningless, encrypted strings.

🔄 Solving the Cross-Platform Sync Problem
One of the coolest challenges was keeping the Desktop, Android, and PWA versions in sync without compromising the encryption.

I implemented a real-time polling mechanism (every 10 seconds). The Rust HTTP client fetches the encrypted vault from the Vercel API, decrypts it locally using the master key in memory, parses the JSON, merges any new accounts, re-encrypts, and pushes it back.

I even had to build a format converter on the fly, because the Android version stores secrets as secret_encrypted (base64 salt+nonce+ciphertext), while the PWA handles plaintext secrets in memory before encrypting the entire vault layer.

🛡️ Ironclad Features
Delete Confirmation: To prevent accidental deletion, users must re-enter their master password before removing any 2FA account.

Optimized Mobile QR Scanner: Using jsQR and requestAnimationFrame, the scanner pulls frames at a low JPEG quality (saving battery and processing at ~30KB/frame) while remaining blazing fast.

🤝 Check it Out!
Building OtpVault was an incredible journey into Rust cryptography and Tauri’s cross-platform capabilities. I’d love for the community to check it out, audit the code, or use it to secure your accounts.

GitHub Repository: [https://github.com/Shadow132245/OtpVault]

Website / Try it out: [https://otpvault1.vercel.app]

I'm open to any feedback, feature requests, or contributions. Let me know what you think of the architecture!

I built an Advanced Python & JS Obfuscator with AI Auto-Decryption 🛡️

Hassan Magdy — Sun, 30 Nov 2025 21:35:12 +0000

Hey Developers! 👋

I'm EuroMoscow, a Full Stack Developer. Recently, I noticed that many online code obfuscators are either paid, outdated, or break the code after encryption (especially with Python versions mismatch).

So, I decided to build my own solution: EuroMoscow Shield 🛡️.

It is a free, mobile-responsive, and powerful tool to protect your Intellectual Property (IP) for both Python and JavaScript projects.

🔗 Try it Live: EuroMoscow Shield

💻 Source Code: GitHub Repository

🔥 Key Features

I wanted to create something robust, so I implemented multiple layers of protection:

🐍 For Python Developers

Safe Renaming: Smart AST parsing that renames variables/functions without breaking your logic.
Portable Blob: A custom technique I developed to compress code into a zlib integer array (Runs on any Python 3.x version, solving the Marshal version error).
EuroMoscow XOR: Custom encryption with dynamic keys.
Import Guard: Automatically detects libraries (sys, os, etc.) and protects them from being renamed.

📜 For JavaScript Developers

Hex Encoding: Converts logic to hexadecimal strings (\x68\x65...).
Char Code Array: Transforms code into number arrays.
URL & Base64 Encoding: Standard web obfuscation layers.

🤖 The "AI" Auto-Decryptor

This is my favorite feature. In the Decryptor section, you don't need to select which algorithm was used.
The engine automatically scans the code using RegEx patterns and heuristically detects the layers (Base64 -> Zlib -> XOR -> Blob) to recover the source code instantly!

📱 Mobile Responsive & Cyberpunk UI

I spent a lot of time polishing the UI. It features a dark "Cyberpunk" theme with:

CodeMirror integration for syntax highlighting.
Client-Side Processing: Files are downloaded directly from the browser (No server size limits!).
Fully Responsive: Works perfectly on mobile devices with a custom sidebar layout.

🛠️ Tech Stack

Backend: Python (Flask)
Frontend: HTML5, CSS3, JavaScript
Deployment: Vercel
Libraries: ast, zlib, base64, codemirror

🚀 API Access

I also built a public API for developers who want to integrate this protection into their CI/CD pipelines.


python
import requests

url = "[https://euro-moscow-shield.vercel.app/process](https://euro-moscow-shield.vercel.app/process)"

payload = {
    "code": "print('Hello Dev.to')",
    "action": "encrypt",
    "lang": "python",
    "options": ["rename", "marshal", "xor"]
}

response = requests.post(url, json=payload)
print(response.json()['result'])

🙌 Feedback
I built this project to help the community protect their open-source tools and bots. I would love to hear your feedback, suggestions, or bug reports!

If you find it useful, please give it a Star ⭐ on GitHub!

Happy Coding! 💻

DEV Community: Hassan Magdy