The 2FA authenticator built for people with more than 10 accounts.

Yes. Everything in the app today, including zero-knowledge sync, is free during the launch period. A premium tier is planned for extras such as automatic cloud backups, more synced devices and smart groups. Code generation, manual encrypted backups and export stay free forever, with no ads.

No. Secrets are encrypted on your device with AES-256-GCM under a key derived from your passphrase with scrypt. The sync server only ever stores ciphertext. It cannot decrypt your vault, and neither could anyone who compromised it.

With encrypted sync enabled, sign in on a new device, enter your vault passphrase, and your entire vault is restored: spaces, groups, tags, everything. Prefer no account? Encrypted backup files, created and restored in the web app, do the same job offline. A lost phone is not a lost identity.

In Google Authenticator, choose Transfer accounts, then Export, and scan the QR with KeyNesta. You get a full preview with duplicate detection before anything is saved, and the whole import can be undone with one tap. Aegis, 2FAS, JSON and CSV work too.

Always. Codes are generated on-device using standard TOTP (RFC 6238); no internet connection is ever required to see your codes. Sync and backups are optional additions, never dependencies.

Two ways. Spaces organize accounts inside one vault, each with its own security policy. For hard separation, create multiple vaults. Each has its own passphrase, encryption key and optional sync account, and unlocking one reveals nothing about another.

Yes, if you want backups and organization. Import your existing codes with the transfer QR, then keep them in encrypted backups, spaces and groups, with a web app on the desktop. The Google Authenticator alternative guide has the full comparison.

Yes. The web app runs in any modern browser at app.keynesta.com with the same vault format as the phone apps, so codes, imports and backups all work on a computer. The web authenticator guide explains how the vault stays private in the browser.

Yes. In the web app, your sync account can use Google, Apple, or an email and password. Signing in only identifies your account for sync. Your vault passphrase stays separate, never leaves your device, and is still what decrypts your codes, so Google and Apple never see them. The iPhone app offers the same choices at launch.

Open the web app, choose Use without an account, then Have a backup file? Restore it instead. Pick your .keynesta file, enter its backup password, and set a new passphrase for this device. If a vault is already open, Settings can replace its contents with the backup instead.

Not yet. KeyNesta uses standard, audited primitives (AES-256-GCM, scrypt, HMAC) and documents the full architecture publicly. An independent review is on the roadmap and will be published when complete.