Freedom251 › Authenticator apps
SentryKey
What SentryKey is
SentryKey is a free TOTP authenticator centered on Garmin watches, with Android and iOS companion apps. A supported Garmin watch generates RFC 6238 codes on-device, including when no phone is nearby. Accounts are added by scanning otpauth:// QR codes on a phone and synchronized to the watch over Bluetooth. More than 100 round Garmin watches are supported; square and rectangular models are excluded. Android encrypts its vault with AES-256-GCM and Android Keystore, while iOS stores secrets in Keychain. Watch secrets remain plaintext because Connect IQ has no keystore. Encrypted backups use PBKDF2-HMAC-SHA256 with 210,000 iterations and AES-256-GCM, and forgotten backup passphrases cannot be recovered. Phone-to-watch synchronization can use a passphrase; without one, the payload is plaintext. The project has no security audit. Android is in closed Google Play beta, with an APK available through GitHub Releases.
Who it suits
SentryKey suits Garmin owners wanting TOTP codes on a watch, including when away from a phone. It is also relevant to users comfortable with a hobby project and beta Android distribution.
What it does well
- Codes generate on the Garmin watch
- Supports Android and iOS companions
- Bluetooth synchronization from phone
- Encrypted Android vault and backups
- Free forever with no ads
What to know first
- Square and rectangular Garmin watches excluded
- Watch secrets are stored plaintext
- Sync is plaintext without a passphrase
- Project has not undergone security audit
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Free | Free forever · no paid tiers · no subscriptions · no ads | Free |
As sentrykey.app lists them, read 11 Oct 2026. The maker's own page has the final word.
Verdict
SentryKey offers watch-based TOTP generation with companion apps, QR setup, Bluetooth sync, and encrypted phone backups. Security trade-offs include plaintext watch storage, optional sync encryption, no audit, and Android beta status.
Facts from SentryKey's own pages
- Android security
- The Android vault is encrypted at rest with AES-256-GCM using a key held in Android Keystore. · github.com, 11 Oct 2026
- Audit status
- The maker describes SentryKey as a personal or hobby project that has not undergone a security audit. · github.com, 11 Oct 2026
- Availability
- The Android app is in closed Google Play beta and an APK is available from GitHub Releases. · github.com, 11 Oct 2026
- Code type
- totp · github.com, 22 Sept 2026
- Encrypted backup
- Yes · github.com, 22 Sept 2026
- Encrypted backups
- Encrypted backups use PBKDF2-HMAC-SHA256 with 210,000 iterations and AES-256-GCM, and the project says a lost backup passphrase cannot be recovered. · github.com, 11 Oct 2026
- Free plan
- Yes · github.com, 22 Sept 2026
- Integrations and imports
- The project documents Garmin Connect IQ Bluetooth sync and QR imports from otpauth:// sources. · github.com, 11 Oct 2026
- iOS security
- The project says iOS secrets are stored in the Keychain. · github.com, 11 Oct 2026
- Multi-device sync
- Yes · github.com, 22 Sept 2026
- Purpose
- SentryKey is a TOTP authenticator for Garmin watches with Android and iOS companion apps. · github.com, 11 Oct 2026
- Setup and sync
- Accounts can be added by scanning otpauth:// QR codes on a phone and synced to the watch over Bluetooth. · github.com, 11 Oct 2026
- Support
- The maker directs users to file bug reports as GitHub issues and accepts optional donations through GitHub Sponsors and Ko-fi. · github.com, 11 Oct 2026
- Supported platforms
- Android,iOS,Garmin Connect IQ · github.com, 22 Sept 2026
- Supported watches
- The app supports more than 100 round Garmin watches and excludes square or rectangular devices. · github.com, 11 Oct 2026
- Sync security
- Phone-to-watch sync can be encrypted with a configured passphrase; without one, the sync payload remains plaintext. · github.com, 11 Oct 2026
- Watch codes
- The Garmin watch generates RFC 6238 TOTP codes on-device, including when no phone is nearby. · github.com, 11 Oct 2026
- Watch storage
- On the watch, secrets are stored in plaintext because Connect IQ has no keystore. · github.com, 11 Oct 2026
Where SentryKey stands on Freedom251
- Authenticator apps#43 of 111