KeyNesta for web
Available now at app.keynesta.com. Current as of 21 September 2026.
The web app is the complete KeyNesta product, not a cut-down companion to a phone app. It opens in any modern browser, needs no install, and needs no account until you want your codes on a second device. If you are here because Authy retired its desktop apps and you want your codes back on the machine you actually work on, this is the page you want.
What you can do in the browser
- Generate codes. TOTP and HOTP, SHA-1, SHA-256 and SHA-512, six to eight digits and custom periods — whatever the service put in its QR code. Computed in the page, with no network involved.
- Add accounts every way. Upload a QR image, paste an
otpauth://link, or type a secret by hand. - Organise properly. Vaults, spaces, nested groups and tags, with ranked search across names, issuers, tags and the full group path.
- Work from the keyboard. A command palette finds and copies a code without reaching for the mouse.
- Import from another app. Google Authenticator transfer QR codes, unencrypted Aegis and 2FAS exports, JSON and CSV — all decoded in the browser.
- Make and restore encrypted backups. Backup files are created and restored here; phones pick the restored vault up through sync.
- Export whenever you like. Your data leaves as easily as it arrived.
How the vault stays private in a browser
The vault is encrypted with AES-256-GCM under a key derived from your passphrase with scrypt, and the decryption happens in the page, on your device. Turn sync on and the server receives ciphertext it has no key for; leave it off and nothing leaves the browser at all. The passphrase itself is never transmitted, which is also why nobody at KeyNesta can reset it for you.
Web authenticator goes through the browser-specific questions — where the vault is stored locally, what a shared computer changes — and the encryption architecture has the scrypt parameters and the sync protocol in full.
What the web app does not do
Honest list, because the gaps matter when you are choosing:
- No camera QR scanning. Upload a QR image or paste the link instead. Camera capture is a phone-app feature.
- No browser extension and no CLI. Neither exists today.
- No shared or team vaults. KeyNesta is built for one person with many accounts.
- Not open source, and no independent audit yet. The cryptography uses audited open-source implementations (noble-ciphers, noble-hashes), but the app itself has not been audited.
The other platforms
Native iPhone and Android apps are built and waiting on their store releases. Until then the web app is the whole product, and it will stay the whole product afterwards — one vault, synced, whichever screen you are at.
Frequently asked questions
Do I need an account to use the web app?
No. Open it, create a vault with a passphrase, and start adding codes. An account is only needed if you want sync, which carries the same vault to another device as ciphertext the server cannot read.
Is a browser a safe place to keep 2FA codes?
The vault is encrypted on your device and the passphrase never leaves it, so the browser is as safe as the machine it runs on. The risk a browser adds is a shared or untrusted computer: on one of those, use a private window, lock the vault when you step away, and do not enable a long auto-unlock.
Can I scan a QR code with my laptop camera?
Not today. Save the QR as an image and upload it, or copy the otpauth:// link the service shows behind its QR and paste that. Camera scanning ships with the phone apps.
Does the web app work offline?
Generating a code needs only the secret and your clock, both of which are local, so codes keep working without a connection. Sync obviously needs one, and it catches up when the connection returns.
Try KeyNesta free. The web app needs no sign-up.
Open the web app All platforms