OTPClient

Free plan Linux

What OTPClient is

OTPClient is a free GPLv3 Linux desktop application for managing TOTP and HOTP two-factor authentication tokens. It supports Steam Guard, SHA1, SHA256, and SHA512, with token settings from four to ten digits and periods of one to 120 seconds. Tokens can be entered manually, through otpauth URIs, or by scanning QR codes from an image, webcam, or clipboard. Migration imports are available from Aegis, AuthenticatorPro, 2FAS, FreeOTPPlus, and Google migration QR codes. The command-line interface can list or show tokens, select databases, import or export data, and produce table, JSON, or CSV output for supported commands. GNOME Shell Activities Search and KDE Plasma 6 KRunner integrations provide desktop search, with Bash, zsh, and fish completions. The local database uses AES-256-GCM and an Argon2id-derived password key. Encrypted backups preserve database bytes and restore as an additional database. OTPClient is offered as a Flatpak, in distribution repositories, and from source. The plan costs nothing.

Who it suits

It suits Linux desktop users managing multiple two-factor tokens who want QR entry, migration tools, command-line access, or encrypted backups. Users of GNOME or KDE can use the listed desktop-search integrations.

What it does well

Supports TOTP, HOTP, and Steam Guard
Scans QR codes from several sources
Imports from multiple authenticator applications
Encrypted database and byte-for-byte backups
CLI offers table, JSON, and CSV output

What to know first

Linux desktop availability only
Unlocked secrets can be exposed by same-UID attacks
Cold-boot or DMA attacks may recover RAM secrets

Plans

Plan	Billed and limits	Price
OTPClient	GPLv3; available as Flatpak, in distro repositories, and from source	Free

As github.com lists them, read 12 Oct 2026. The maker's own page has the final word.

Verdict

OTPClient offers broad token support, migration, command-line controls, and encrypted local storage at no listed cost. Its documented attack scenarios matter when deciding how to protect an unlocked Linux machine.

Facts from OTPClient's own pages

Availability and license: The project says OTPClient is available as a Flatpak and in several distribution repositories, and that it is released under GPLv3. · github.com, 12 Oct 2026
Backup: Token backups are byte-for-byte copies of the encrypted database written with 0600 permissions, and restoring opens the backup as an additional database without overwriting the active one. · github.com, 12 Oct 2026
Code type: totp and hotp · github.com, 22 Sept 2026
Command line: The CLI can list or show tokens, select databases, import or export data, and produce table, JSON, or CSV output for supported commands. · github.com, 12 Oct 2026
Desktop integrations: Its desktop search provider integrates with GNOME Shell Activities Search and KDE Plasma 6 KRunner, and the CLI includes Bash, zsh, and fish completions. · github.com, 12 Oct 2026
Encrypted backup: Yes · github.com, 22 Sept 2026
Import and export: It supports migration with Aegis, AuthenticatorPro, 2FAS, FreeOTPPlus, and Google migration QR codes (import only). · github.com, 12 Oct 2026
Local encryption: The local database uses AES-256-GCM encryption with a password-derived Argon2id key; the documented defaults are 4 iterations, 128 MiB memory, and parallelism 4. · github.com, 12 Oct 2026
Maker: The GitHub repository is owned by Paolo Stivanin, whose profile lists Italy and SUSE. · github.com, 12 Oct 2026
Memory protection: The project says decrypted token data and secrets are held in locked libgcrypt secure memory and wiped from memory when the database is locked. · github.com, 12 Oct 2026
OTP support: It supports TOTP, HOTP, Steam Guard codes, SHA1/SHA256/SHA512, and manual or otpauth URI token entry with 4–10 digits and 1–120 second periods. · github.com, 12 Oct 2026
Purpose: OTPClient is a GTK4/libadwaita application for managing TOTP and HOTP two-factor authentication tokens, with CLI and desktop-search integration. · github.com, 12 Oct 2026
Security limits: The security policy says a same-UID attacker with ptrace or /proc/PID/mem access can read secrets while the database is unlocked, and cold-boot or DMA attacks can recover secrets from RAM on an unlocked machine. · github.com, 12 Oct 2026
Security support: The security policy lists version 5.1.x as Active, 5.0.x as Maintenance, and versions below 5.0 as End of life. · github.com, 12 Oct 2026
Supported platforms: Linux desktop · github.com, 22 Sept 2026
Token entry: Tokens can be added by scanning a QR code from an image, webcam, or clipboard, or by entering the secret manually. · github.com, 12 Oct 2026
Vulnerability reporting: The security policy asks researchers to report vulnerabilities by email rather than opening a public issue, and says acknowledgment is within 24 hours and a fix will be developed and released within 7 days. · github.com, 12 Oct 2026

Where OTPClient stands on Freedom251

Authenticator apps#73 of 111