Twilio discontinued the Authy desktop apps for Windows, macOS and Linux — announced in January 2024 for August, then brought forward to 19 March 2024. Authy became a phone-only product, and a large number of people who had been typing codes on the machine they work on were told to pick up their phone instead.

If you spend your day in cloud consoles, that is not a small ask. An AWS console, a GitHub organisation, a Cloudflare dashboard and a payment provider in one afternoon is a dozen reach-for-the-phone interruptions.

What the options actually are

Phone app plus patience. The default. Works, costs nothing, and is the thing you were trying to avoid.

A password manager that also holds your codes. Bitwarden, Proton Pass, 1Password and Apple Passwords all store verification codes alongside passwords, and they all run on a desktop. It is genuinely convenient. It also puts both factors behind one unlock, which removes most of the point of having two.

Another phone-first app with a desktop build. Proton Authenticator ships macOS, Windows and Linux apps; Ente Auth has desktop and web clients. Both are open source, both sync end-to-end encrypted. If open source is a hard requirement for you, start there.

A browser-based authenticator. No install, nothing to update, runs on a work laptop you are not allowed to install software on. The design question is where the vault and the key live.

What to check before trusting one

A vault that lives in a browser is only as good as its answers to four questions. They are worth asking of any authenticator, including this one.

  • What is the key derived from, and how slowly? A passphrase stretched with a deliberately expensive function — scrypt, Argon2 — is a different proposition from one hashed once and stored.
  • When is the key discarded? If it survives in memory after the vault locks, the lock is decoration.
  • What does the server actually receive? "Encrypted in transit" and "the server cannot decrypt it" are different claims, and only one of them survives a breach of the server.
  • Can you get your codes out again? An app with no export has quietly made itself your next migration problem. Authy is the worked example.

Nothing on that list is exotic, and an app that will not answer it in writing has told you something.

How KeyNesta answers it

The KeyNesta web app is the whole product, not a companion to a phone app: adding codes, importing, organising, encrypted backups and sync all happen there. No install, no sign-up to start, no phone number anywhere.

The part that matters for the safety question: the vault is encrypted in browser storage with AES-256-GCM under a random 256-bit master key. Your passphrase does not encrypt the vault directly — it is stretched with scrypt and used to wrap that master key. The key only exists in memory while the vault is unlocked, and is discarded when it auto-locks. Sync is optional and zero-knowledge: each entry, group and space is encrypted before it leaves the device, so the server holds ciphertext, object ids and version numbers, and cannot decrypt any of it.

For the many-consoles case specifically: spaces and nested groups instead of one flat list, tags across the hierarchy, ranked search over name, issuer, account and the full group path, and a keyboard-driven command palette so finding a code does not cost you your hands. Non-default TOTP parameters are handled properly — SHA-256 and SHA-512, 8 digits, HOTP counters — which matters more on infrastructure accounts than consumer ones.

The honest limits, since this is a comparison: KeyNesta is not open source and has not had an independent security audit yet. There is no desktop application and no browser extension — the answer here is a web app, not a native build. There are no shared or team vaults. The iPhone and Android apps are built and waiting on store review.

Web authenticator explains how the browser vault is protected in more detail, and features lists everything shipped alongside everything that is not.

Common questions

Why did Authy remove its desktop apps?

Twilio announced the end of life in January 2024, originally for August, and then brought the date forward to 19 March 2024. The stated direction was mobile-only. Existing installs stopped being supported; there was no desktop replacement.

Is keeping 2FA codes in a browser less safe than on a phone?

It depends on what the browser holds. A vault encrypted on the device, where the key is derived from a passphrase and only exists in memory while unlocked, is a different proposition from a browser extension that keeps secrets readable at rest. The question to ask any web authenticator is where the key lives and when it is discarded.

Can I use a browser authenticator and a phone app at the same time?

Yes, if the app has real sync. The same vault on both means you take a code from whichever device is in front of you. Without sync you are maintaining two lists by hand, which is how accounts go missing.

Sources