Everything KeyNesta does
Current as of 21 September 2026. Shipped features only.
KeyNesta is a two-factor authentication app for people whose list of codes stopped being a list a long time ago. It generates standard TOTP and HOTP codes like every other authenticator; the difference is what happens once you have more than a screenful of them. This page describes what the app does today. Anything still being built is named as such at the bottom.
Codes that follow the standard, exactly
- TOTP and HOTP (RFC 6238 and RFC 4226), generated on the device, with no network involved.
- SHA-1, SHA-256 and SHA-512, six to eight digits, and custom periods — whatever the service put in its QR code, not just the common defaults.
- Every way in: scan a QR with the camera, upload a QR image, paste an
otpauth://link, or type the secret by hand. - A live countdown on each entry, one-tap copy, and a clipboard that clears itself afterwards.
If you want the mechanism rather than the feature list, see TOTP vs HOTP: how authenticator codes work.
Four levels of organization
Most authenticators give you one flat list and a search box. KeyNesta gives you a structure that survives a few hundred entries:
| Level | What it is | Example |
|---|---|---|
| Vault | A separate encrypted database with its own passphrase and its own sync account. Cryptographically independent from your other vaults. | Personal · Client work |
| Space | A coloured top-level division inside a vault, with its own auto-lock and visibility policy. | Work · Personal · Servers |
| Group | A folder inside a space. Groups nest as deep as you need. | AWS → Production |
| Tags | Labels that cut across the hierarchy, for the things a folder tree cannot express. | #root #shared #legacy |
Plus favourites for the handful you use daily, an archive for the ones you cannot delete but never open, and a trash that keeps deleted entries for 30 days in case you were wrong. How this works at 200 accounts goes through it properly.
Finding one code in hundreds
Search is ranked and searches everything: entry name, issuer, account name, tags, and the full group path. Typing prod aws finds the production root account without you remembering which space you filed it under. On the web app there is a keyboard-driven command palette for the same job, because taking your hand off the keyboard to find a code you are about to type is a small daily insult.
Encryption you can describe in one sentence
Your vault is encrypted on your device with AES-256-GCM under a random 256-bit master key. Your passphrase does not encrypt the vault; it is stretched with scrypt and used to wrap that master key, so changing the passphrase rewrites one small block instead of re-encrypting everything. On iPhone and Android the master key can live in the hardware-backed Keychain or Keystore behind Face ID or a fingerprint. Vaults auto-lock, and the key is discarded from memory when they do.
Read it in plain language on the security overview, or with the actual parameters on the encryption architecture page.
Backups and sync, both of which you control
- Encrypted backup files. A single file, encrypted with a password you choose, that you keep wherever you keep important files. No account needed, ever.
- Zero-knowledge sync. Optional. Each entry, group and space is encrypted individually before it leaves the device. The server stores ciphertext, object ids and version numbers, and cannot decrypt any of it.
- Device management. See every device on the sync account and revoke any of them; a revoked device stops working at the next request, not at the next login.
- Conflict handling. Edit the same entry on two devices and neither edit is thrown away — the loser becomes a clearly marked "(conflict)" copy for you to resolve.
Details and the new-phone walkthrough: 2FA backup and sync.
Nothing that holds you hostage
Import from Google Authenticator's transfer QR, Aegis, 2FAS, generic JSON, CSV, or a list of otpauth:// URIs. Every import shows a preview with duplicates flagged before anything is saved, and the whole thing can be undone in one action if the preview was not what you expected. Export is a plain standard file whenever you want one, including on the way out. See the Google Authenticator and Aegis and 2FAS guides.
Where it runs
The web app works today in any modern browser with no install and no sign-up — the vault is encrypted in browser storage, and the master key only exists in memory while it is unlocked (how that is kept safe). The iPhone and Android apps are native, share the same encryption core, and are in the queue for their stores. No browser extension, no desktop app.
What is not built yet
Named here so you do not discover it after switching: no smart groups or saved filters, no automatic cloud backups, no browser extension, no widgets or watch apps, no sharing or team vaults, no notes or custom fields on entries, no passkeys, and the interface is English only. Real service logos are not shipped either — entries get generated avatars. Some of these are planned; none of them exist today.
Frequently asked questions
What is the difference between a vault, a space and a group?
A vault is a separate encrypted database with its own passphrase, its own master key and its own sync account: use one when things must be genuinely separate. A space is a coloured division inside a vault, for work versus personal. A group is a folder inside a space, and groups nest. Only the vault boundary is a cryptographic one.
Is there a limit on how many codes, spaces or vaults I can have?
No. Entries, spaces, groups, nesting depth, tags and vaults are all unlimited and always have been. The practical limit on vaults is that each one has its own passphrase, and passphrases you rarely type are passphrases you forget.
Which platforms can I use today?
The web app is live at app.keynesta.com and needs no install or sign-up. The iPhone and Android apps are built and waiting on their store review queues. There is no desktop app and no browser extension.
Do the apps need an internet connection?
Only for sync. Generating codes uses the secret and your clock, both of which are on the device, so the app works on a plane, on a phone with no SIM, or with the network off entirely.
Try KeyNesta free. The web app needs no sign-up.
Open the web app All platforms