A 320×480 popup anchored to the tray icon, summoned by a hotkey and dismissed the moment it loses focus. No Dock icon, no taskbar entry, no window to manage — and the same Rust core the browser extension runs.
v0.1.0 · Tauri 2 · free and MIT licensed · no account required
THE WINDOW
A panel, not an application.
The window starts hidden and is anchored to the tray icon each time it opens — below the menu bar on macOS, above the taskbar on Windows and Linux, and clamped so it never lands off-screen on a second monitor.
Locked by default
Every launch starts here — unless you let the OS keyring remember the passphrase, in which case it opens straight to the list.
Search, or just press ⌘1
Codes rotate in place with the ring underneath. The top accounts get ⌘1 to ⌘5, so copying one never needs the mouse.
Everything in one panel
Export and import the vault, change the password, set auto-lock and the summon hotkey, open at login, turn on sync.
Hides the moment it loses focus
Click anywhere else and it is gone. Nothing to close, nothing left open behind your work.
No Dock icon, no taskbar entry
macOS runs it as an accessory app; Windows and Linux skip the taskbar. It exists in the tray and nowhere else.
Always on top, never resizable
It opens at one size in one place, so the code you want is always in the same spot.
Resizes itself to the content
The frontend measures itself and the window follows, so short lists do not leave empty space.
WHAT IT DOES
Built for the two seconds you actually need it.
Summon, copy, gone. Everything else — setup, settings, sync — is there when you go looking for it and invisible when you are not.
A hotkey from anywhere
⌘⇧U on macOS, Ctrl+Shift+U elsewhere, and rebindable to whatever you like. The choice is written beside the vault, so it survives updates.
CmdOrCtrl+Shift+U
Quick copy from the tray
Right-click the tray icon and your five most recent accounts are right there, no window needed. The list only appears while the vault is unlocked.
5 recent accounts
Unlocks from the OS keyring
Choose to remember and the passphrase goes into the system keyring, so you type it once per device rather than once per launch.
keyring · opt-in
Starts with your session
LaunchAgent on macOS, a Run key on Windows, an autostart .desktop on Linux — the real OS mechanism each time, not a setting we invented.
launch at login
Corrects a wrong clock
TOTP breaks when the machine clock drifts. 2FAu samples a trusted time over HTTPS four times, keeps the fastest round-trip, and stores the offset — not the instant.
4 samples · lowest RTT
Import what you already have
Bring accounts across with otpauth migration URIs, or move the whole encrypted vault between machines by exporting and importing the blob.
otpauth · vault export
TOTP and HOTP
Time-based codes rotate on their own; counter-based ones advance when you ask, so hardware-style tokens work the same as everything else.
RFC 4226 · RFC 6238
Hosts the sync bridge
The desktop app serves the browser extension over loopback on port 4849. Pairing codes expire, each browser gets its own bearer token, and you can revoke any of them.
127.0.0.1:4849
Copy without the mouse
The configured modifier plus a digit — ⌘1 to ⌘5, Ctrl elsewhere — copies that row's code. Each row shows its own badge, so you never count positions.
modifier + 1…5
Search once the list grows
Start typing and the list filters down. The field only appears when you have enough accounts to need it, so a short vault stays uncluttered.
type to filter
THREE PLATFORMS
One binary per OS, built the native way.
Where the platforms disagree, 2FAu follows the platform instead of inventing its own convention. These are the places that actually differ.
MACOS
WINDOWS
LINUX
Launch at login
LaunchAgent
registry Run key
autostart .desktop
Popup anchor
below the menu bar
above the taskbar
above the taskbar
App presence
accessory — no Dock icon
skips the taskbar
skips the taskbar
Released for
Apple silicon
x86-64
x86-64 · Ubuntu 22.04
Code signing
not yet signed
not yet signed
n/a
DOWNLOAD
Put it in your menu bar in under a minute.
No account, no installer bundled with anything else, and the whole vault stays on the machine you install it on.
Builds are not code-signed yet, so macOS and Windows will warn on first launch. Verify the checksum, or build it yourself — the whole thing is MIT licensed.