Every authenticator is fine at twelve codes. The list fits on a screen, you recognise the icons, and search is a nicety. The experience is designed for that case, and most apps never leave it.
Then you pick up a few client accounts, a second AWS organisation, the staging copies of everything, a handful of legacy logins you cannot delete, and one day you are scrolling a list of two hundred six-digit numbers looking for the one that says prod somewhere in it. Search helps, but only if you remember what the entry was called, and issuers are not consistent about that.
This is the feature request that sits open in the issue trackers of nearly every authenticator app: folders. Aegis has groups, on Android. Ente Auth has tags. The rest give you one list.
What organisation actually needs to be
Four different problems get confused with each other here.
Separation. Client work that must not be visible in the same place as your personal accounts. This is not a filing problem, it is a boundary problem, and a folder does not solve it.
Division. Work versus personal versus infrastructure. A top-level split you want to see at a glance.
Nesting. AWS → Production → root. Real structures are trees, two levels deep is not enough, and every service you manage has its own depth.
Cross-cutting labels. The things a tree cannot express: everything that is a root credential, everything shared with a contractor, everything legacy. An entry needs to be in one folder and in several of these at once.
KeyNesta has one level for each. Vaults are the boundary: a separate encrypted database with its own passphrase, its own master key and its own sync account, cryptographically independent of your other vaults. Spaces are the division: a coloured top-level split inside a vault, each with its own auto-lock and visibility policy. Groups are folders inside a space, and they nest as deep as you need. Tags cut across all of it. Plus favourites for the handful you use daily, an archive for the ones you never open but cannot delete, and a trash that holds deleted entries for 30 days in case you were wrong.
Entries, spaces, groups, nesting depth, tags and vaults are all unlimited, and always have been.
Structure is only half of it
A hierarchy you have to navigate is a hierarchy you will stop using. Search in KeyNesta is ranked and covers the entry name, the issuer, the account name, the tags and the full group path — so typing prod aws finds the production root account whether or not you remember which space it went into. In the web app the same job has a keyboard-driven command palette, because taking your hand off the keyboard to find a code you are about to type is a small daily insult.
The filing also syncs. Spaces, groups and tags are encrypted and synced as objects in their own right, so the structure you built on one device is the structure you see on the next one, rather than something you rebuild per device.
The honest part
KeyNesta is not open source and has not had an independent security audit yet. There are no smart groups or saved filters — the hierarchy is manual. There are no shared or team vaults, so this is organisation for one person with many accounts, not for a team. The iPhone and Android apps are built but still waiting on their store queues, so today the product is the web app, which needs no install and no sign-up.
How this works at 200 accounts walks through the structure with real examples, and features lists everything shipped next to everything that is not.
Common questions
Which authenticator apps let you organise codes into folders?
Aegis has groups on Android, and Ente Auth has tags. Google Authenticator, Microsoft Authenticator, Authy, 2FAS and Bitwarden Authenticator give you a single list, with search and manual reordering. KeyNesta is built around the hierarchy: spaces, nested groups, tags and separate encrypted vaults.
What is the difference between a folder and a separate vault?
A folder is organisation; a vault is a boundary. In KeyNesta a group is a folder inside a space, and only the vault boundary is cryptographic — a separate vault has its own passphrase, its own master key and its own sync account, so it is genuinely independent rather than just filed elsewhere.
Does the structure survive a move to another device?
In KeyNesta, yes — spaces, groups and tags are encrypted and synced as objects in their own right, not inferred from entry names. Most import formats from other apps carry entry data only, so a hierarchy built elsewhere usually does not travel.