A 2FA authenticator for developers, DevOps and sysadmins

Updated 21 September 2026.

Developers hit the limits of authenticator apps earlier than anyone else, because the job hands out second factors faster than any other job. A realistic inventory: GitHub and GitLab, an AWS root account plus an IAM user per account per environment, Cloudflare, a registrar, npm and PyPI, a password manager, a VPS provider, monitoring, the CI system, a payments dashboard — and then the same list again for every client you administer.

None of that fits in a flat list, and the parts that break first are exactly the ones a consumer-focused authenticator is not designed for.

Structure that matches how infrastructure is actually organized

KeyNesta files codes as vault → space → nested groups → entry, with tags cutting across. In practice that means provider, then environment, then account — or client, then provider — and search that knows the whole path, so prod aws root resolves without you remembering the filing:

Infra                    Clients
 ├─ AWS                   ├─ Client A
 │   ├─ Production        │   ├─ Cloudflare
 │   │   └─ root  #root   │   └─ AWS  #handover
 │   └─ Staging           └─ Client B
 ├─ Cloudflare                └─ Registrar
 └─ Registrars

Client work generally belongs in its own vault rather than a space: separate passphrase, separate master key, separate sync account, so it can be handed over or abandoned cleanly at the end of an engagement. The full reasoning is on managing many accounts.

The standards support that actually bites

Consumer authenticators tend to assume SHA-1, six digits, thirty seconds, because that is what consumer services issue. Enterprise and infrastructure providers do not always agree, and an app that silently ignores the parameters in the QR produces codes that are wrong for reasons nobody can debug at 2am.

• SHA-1, SHA-256 and SHA-512, whichever the otpauth:// URI specifies.
• Six, seven and eight digits, and non-default periods.
• HOTP counters, not just TOTP — the hardware-token and banking case.
• Full otpauth:// parsing, including the parameters most apps drop on import.

What each parameter does, and why a wrong clock breaks everything: TOTP vs HOTP.

Machine-readable in and out

Import accepts Google Authenticator's transfer protobuf, Aegis, 2FAS, generic JSON, CSV, and a plain list of otpauth:// URIs — which is the one that matters when you are consolidating from a script, a spreadsheet or another engineer's handover notes. Duplicates are flagged in a preview before anything is written, and the whole import is undoable in one action.

Out is the same story: a plain standard export whenever you want one, and encrypted backup files that are just files, encrypted with a password you chose, stored wherever you keep things. No API is required to get your own data, and nothing is retained on the way out.

Zero-knowledge, for people who would otherwise self-host

The usual developer answer to cloud sync is not to use it. KeyNesta's sync is built so that refusing is not necessary: each entry, group and space is encrypted individually on the device with a master key the server never sees, under AES-256-GCM with per-object AAD, and the key is wrapped by a scrypt-derived KEK from your passphrase. The server holds object ids, version numbers and ciphertext. Writes are version-checked with conflict copies rather than last-write-wins, deletions are final tombstones, and device revocation is enforced per request.

If you would rather read the parameters than the paragraph, they are all on the encryption architecture page, threat model and known limits included.

What is missing, stated plainly

You will find this out in the first week, so here it is in the first five minutes:

• No CLI and no API. Codes are not scriptable from KeyNesta today.
• No browser extension and no desktop app — the web app is the desktop story.
• No team vaults, sharing, roles or audit logs. A shared credential can live in a separate vault whose passphrase you share out of band, and that is the whole of it.
• No otpauth:// deep-link handler registered on iOS or Android yet, so links have to be pasted rather than tapped.
• No smart groups — filing is manual — and no automatic backups. Backups are something you do, not something that happens.
• No independent cryptographic audit yet. Standard primitives, audited libraries, no third-party review of the implementation.

Most of those are on a roadmap. None of them are true today, and a comparison table that quietly ticked them would be worth less to you than this list.

Frequently asked questions