DEV Community

Cover image for Smart2FA: An Offline, Zero-Knowledge 2FA Authenticator Built for Maximum Security and Minimal Friction
TechnoL0g
TechnoL0g

Posted on Edited on

Smart2FA: An Offline, Zero-Knowledge 2FA Authenticator Built for Maximum Security and Minimal Friction

#opensource #security #rust #2fa

A deep dive into Smart2FA (0xid Edition) - an open-source, 100% offline 2FA authenticator with local AES-256 encryption, biometrics, and cross-platform desktop/mobile support.

Security vs. Convenience: The Authentication Dilemma

In modern digital infrastructure, two-factor authentication (2FA) is one of the highest-leverage practices for preventing unauthorized account access. Yet most mainstream authenticator applications introduce unnecessary trade-offs:

  1. Centralized Cloud Sync Risks: Storing unencrypted or vendor-managed tokens in proprietary clouds introduces unnecessary attack surfaces, single points of failure, and vendor lock-in.
  2. Excessive Telemetry & Tracking: Many commercial authenticators harvest analytics, device identifiers, and usage metrics, adding cognitive and privacy overhead.
  3. Platform Lock-In & Friction: Limited export options make migrating between ecosystems unnecessarily difficult, increasing the risk of data loss when changing devices.

To maximize user autonomy, data protection, and operational efficiency, we built Smart2FA (0xid Edition) - an open-source, client-side, zero-knowledge authenticator designed to eliminate telemetry, minimize systemic vulnerability, and deliver maximum utility with an industrial aesthetic.

Core Philosophy: Zero-Knowledge & Local-First Utility

Smart2FA is engineered around three foundational requirements:

  • 100% Offline by Design: No backend services, no analytics, no external network calls.
  • Client-Side Cryptographic Isolation: All secrets remain encrypted at rest and in memory until explicitly authenticated by the user.
  • Portability and Interoperability: Support for standard RFC formats, instant bulk migrations, and frictionless cross-platform access across Web, Desktop (Tauri/Rust), and Mobile (Capacitor).

Capabilities & Architectural Overview

1. Robust Cryptographic Vault Model

Smart2FA never persists your master PIN in plaintext. The storage and decryption flow maximizes resilience against brute-force and local data-dump attacks:

[ User PIN ]
    |
    |-> PBKDF2 (25,000 iters, Salt A, SHA-256) -> PIN Hash (Verification only)
    |
    └-> PBKDF2 (25,000 iters, Salt B, SHA-256) -> AES-256-CBC Key -> Encrypts/Decrypts Vault
Enter fullscreen mode Exit fullscreen mode
  • In-Memory PIN Lifecycle: Decrypted state and working secrets reside strictly in volatile RAM within the Pinia store. Locking the app, navigating away, or refreshing the page immediately purges volatile memory.
  • Biometric Integration (WebAuthn): On supported devices (Touch ID, Face ID, Windows Hello), WebAuthn securely wraps the key, providing frictionless single-touch authentication without compromising cryptographic strength.
  • Automated Inactivity Protection: Configurable auto-lock triggers after idle intervals (30s to 30m) to minimize risk in shared environments.
  • Irreversible Panic Wipe: A high-safety wipe mechanism requiring explicit text confirmation (WIPE) instantly sanitizes all local keys and storage artifacts.

2. RFC 6238 TOTP Engine & Real-Time Ergonomics

  • Broad Protocol Support: Powered by otpauth, supporting SHA-1, SHA-256, and SHA-512 algorithms, 6, 7, or 8-digit codes, and custom time periods (30s / 60s).
  • Visual Expiration Feedback: A real-time countdown progress bar indicates time-to-expire, shifting to an alert state 5 seconds prior to renewal.
  • Instant Copy: One-touch clipboard copying accompanied by concise status notifications.

3. Dual Input, Auto-Categorization & Google Auth Import

  • Integrated QR Scanner: Real-time camera scanner via html5-qrcode with automated otpauth:// URI parsing.
  • Google Authenticator Batch Migration: Scans Google Authenticator's native "Transfer Accounts" export QR code to migrate dozens of tokens in a single operation.
  • Smart Category Detection: Automatically classifies tokens into color-coded categories (Work, Crypto, Finance, Social, Email, Gaming, Other) based on issuer patterns (e.g., GitHub $\rightarrow$ Work, Binance $\rightarrow$ Crypto), with one-tap filtering tabs.

4. Encrypted Portability (.oxid Format)

  • Vaults can be exported as timestamped .oxid files, encrypted with AES-256 derived from the export PIN.
  • These encrypted containers can be safely archived in cold storage or transferred via insecure channels without exposing token secrets.

5. Cross-Platform Desktop & Mobile Support

  • Tauri v2 (Rust Backend): High performance, minimal binary footprint, full system tray integration, and minimize-to-tray capability for unobtrusive background operation.
  • Capacitor Mobile Build: Ready for deployment on Android devices.
  • Responsive Industrial Interface: High-contrast Dark Charcoal (#1A1B1E) and Rust Orange (#E25822) theme with glassmorphism and monospace typography.

Tech Stack

  • Frontend: Vue 3 (Composition API & <script setup>), Pinia 2, Vue Router 4, Tailwind CSS.
  • Desktop Runtime: Tauri v2 (Rust).
  • Mobile Foundation: Capacitor.
  • Security & TOTP Primitives: crypto-js, otpauth, html5-qrcode.

Ideas for Future Development

To continuously improve the security-to-effort ratio, several potential enhancements are under consideration:

  1. Hardware Security Key (FIDO2 / YubiKey) Support: Allowing master vault keys to be backed by a physical hardware token for enhanced physical security.
  2. Encrypted P2P Local Network Sync: Safe, serverless peer-to-peer sync between desktop and mobile devices via local encrypted WebRTC or chunked animated QR codes.
  3. CLI Companion Utility: A headless CLI tool for developers to query TOTP tokens directly from their terminal during SSH or CI/CD operations.
  4. Custom Category Rules & Custom Icons: Allowing users to define regex-based categorization rules and custom issuer icon packs.
  5. Decentralized Encrypted Cloud Storage Backends: Optional integration with WebDAV or user-owned S3 buckets to back up encrypted blobs automatically without vendor intermediaries.

Open Source & Getting Started

Smart2FA is 100% open-source under the MIT license. Check out the repository, star the project, and inspect the codebase:

-->> GitHub Repository: https://github.com/technologiespro/Smart2FA

Community Feedback

Tools are most effective when they adapt to the practical workflows of real users.

What capabilities or integrations would provide the highest value for your daily security setup? What features would you like to see added to Smart2FA next?

Share your thoughts, suggestions, and feedback in the comments below, or open an issue on GitHub!

photo_2026-05-20_08-55-36

Top comments (1)

Collapse
 
technologiespro profile image
TechnoL0g •

In the next version I plan to get rid of crypto-js. Version 4.2.0 of crypto-js is the latest published version of the library. In the current Smart2FA codebase, it contains no critical vulnerabilities and performs its intended function; however, in the context of modern web and mobile development, the library itself is considered outdated.

In future major releases, migrate src/lib/crypto.js to use the native window.crypto.subtle API (switching to AES-GCM); this will improve performance and reduce the size of dependencies.