2FAuth Hosting

How 2FAuth works

2FAuth saves TOTP, HOTP, and supported Steam code records, then generates the current one-time password when an authorised user opens the vault. Accounts can be added by scanning a QR code, entering details manually, or importing migration data from supported authenticator formats. Groups, search, icons, and visibility controls help keep a larger collection understandable.

The current project supports individual and multi-user use, isolated personal vaults, controlled registrations, shared codes, passwords, passkeys, authentication proxies, and personal access tokens. The catalogue template creates no account in advance: the first visitor registers the administrator, so that step must be completed before the address is distributed.

Key 2FAuth features

Import tools reduce the effort of moving codes from supported authenticators, while selective JSON exports provide a portable backup or migration resource. Users can organise entries by group, search for services, and generate codes from a browser instead of depending on a single handset.

Security depends on more than the application image. Access to the domain, administrator credentials, passkeys, exports, and database all matters. An attacker who obtains both the primary password and the stored OTP secrets may bypass the separation that two-factor authentication is meant to provide, so administrators should restrict access and maintain offline recovery material.

2FAuth vs 1Password

2FAuth is a focused self-hosted OTP manager with import, export, sharing, and browser access. 1Password is a managed password manager that can store passwords, passkeys, documents, and one-time passwords, then fill supported credentials and codes through its browser and device applications.

1Password may suit users who want one provider-operated vault for passwords and OTP autofill across supported devices. 2FAuth is a better fit when the goal is an independently hosted code vault and the operator accepts responsibility for account recovery, domain security, exports, and database protection.

Who uses 2FAuth

Individuals can centralise codes that were previously divided across several authenticator apps. Families or small teams may use separate vaults and controlled sharing for common services, while administrators keep export files available for disaster recovery or migration.

A web-based OTP vault creates a concentration of sensitive secrets. It should not be treated like an ordinary notes application. Register the first administrator promptly, use strong authentication, limit registrations, protect exported migration files, and confirm that another recovery method exists before relying on a passkey-only login.

Self-hosting 2FAuth: requirements and cost

Workload is driven by users, stored OTP entries, imports, exports, sharing, search, audit events, and concurrent browser sessions. PostgreSQL stores accounts, encrypted secrets, permissions, and application state. The database is included but unmanaged, and its memory is not part of the 512 MB application minimum in the catalogue.

AvaHost maps 2FAuth to Plan 2 at €5 after the database step-up. The 2FAuth package includes one-click setup, automated HTTPS for a chosen hostname, application updates, and scheduled backups. Application email is disabled, so emailed recovery links are unavailable, including the documented passkey-recovery path. Complete first-user registration immediately and keep secure exports or alternate authentication methods outside the hosted instance.