Open-source 2FA is a category, not a single app. For personal use, a self-hosted OTP vault such as 2FAuth can organize TOTP codes. For an organization, privacyIDEA can enforce multiple factors across SSH, VPNs, Keycloak and web applications. TOTP works offline and is broadly compatible; WebAuthn/FIDO2 security keys and passkeys provide stronger phishing resistance. Choose according to the systems you must protect, your recovery plan and whether you can operate a server securely.
What “open-source 2FA” includes
Two-factor authentication adds a second proof of identity to a password or other first factor. In open-source deployments, that second factor can be managed at three different layers:
As an Amazon Associate I earn from qualifying purchases.
- Local authenticator: an app or browser tool creates one-time passwords.
- Self-hosted vault: a server stores and organizes your OTP secrets for one person or a small team.
- MFA server: centralized infrastructure connects many applications and identity stores to a common policy.
These layers are complementary. A vault helps you use 2FA; an MFA server decides how users authenticate to business systems.
Which protocol should you use?
| Factor | How it works | Strengths | Trade-offs |
|---|---|---|---|
| TOTP | The client and server share a secret and derive a time-based code, commonly from an otpauth:// QR code. |
Works without internet access, is supported by most services and can be entered manually. | The shared seed must be protected; phishing sites can relay a valid code, and codes can be replayed unless the server rejects reuse. |
| HOTP | The client and server share a secret and advance a counter for each code. | Useful where a counter-based token is appropriate and does not depend on clock synchronization. | Counter drift and resynchronization require operational handling; it has the same shared-secret exposure as TOTP. |
| WebAuthn/FIDO2 | A browser uses a scoped public-key credential held by a passkey or security key. | Strong phishing resistance, origin binding and no reusable OTP seed on the server. | Device availability, browser support, account recovery and cross-device portability must be planned. |
PyOTP’s guidance for HOTP/TOTP includes controlled-access seed storage, HTTPS, replay prevention and throttling of brute-force attempts. For new systems, it recommends considering WebAuthn or U2F because asymmetric credentials and origin scoping better resist phishing and a server-side secret breach.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The WebAuthn Level 3 Recommendation, published by the World Wide Web Consortium on 25 August 2026, defines a browser API for strong, attested and scoped public-key credentials. The browser mediates access to the authenticator, which also helps preserve user privacy.
Best open-source projects by use case
| Project | Best fit | Key capabilities | Important limitation or condition |
|---|---|---|---|
| 2FAuth | Individuals and small teams wanting a self-hosted browser OTP vault | QR and manual enrollment, import/export, browser code generation, encrypted secrets, multi-user isolation, audit logs, passkey-protected accounts, Docker and NGINX/Apache deployment | Browser extensions require a running 2FAuth instance; you remain responsible for server security and backups. |
| privacyIDEA | Organizations needing centralized MFA policy and integrations | AGPLv3 self-hosting; AD, LDAP, SQL and Entra ID integration; Keycloak, VPN/RADIUS, SSH, Linux PAM, Windows Credential Provider and REST APIs; TOTP/HOTP, passkeys, FIDO2, smartcards, push, SMS and email | It is an infrastructure platform, not a simple personal authenticator, so deployment and administration are more involved. |
| PyOTP | Developers adding HOTP or TOTP to an application | Generates and validates OTPs and provisions them with otpauth:// QR codes |
It is a library, not a user-facing vault or complete MFA service. You must implement secure storage, throttling, replay checks and recovery. |
| authenticator-sh/2fa | Users who want a browser-based TOTP authenticator | Encrypted records and backups, with optional passkey wrapping through the WebAuthn PRF extension | PRF support varies by platform; verify compatibility before making it part of your recovery design. |
How to self-host an OTP vault with 2FAuth
2FAuth is the most direct choice when you want a private, browser-accessible place to manage codes without adopting an organization-wide MFA server.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Choose a host: use a maintained Docker host, NAS or on-premises server that you can patch and monitor.
- Deploy the application: follow 2FAuth’s documented Docker or NGINX/Apache deployment method rather than exposing an unconfigured development instance.
- Enable HTTPS: protect login traffic and every browser session with a valid TLS configuration.
- Create isolated accounts: use separate user vaults instead of sharing one administrator login. 2FAuth documents multi-user isolation and audit logs for this purpose.
- Enroll accounts: scan each service’s QR code or enter its secret manually, then confirm that the generated code works before disabling the old factor.
- Back up and test export: protect encrypted database and export backups as highly sensitive credentials, and periodically verify that a restore is usable.
- Protect the vault itself: add a passkey where supported, restrict administrative access and review audit events.
A self-hosted vault removes dependence on a hosted password manager, but it does not remove operational responsibility. A stolen database containing OTP seeds can let an attacker generate valid codes, so treat it with the same care as a password store.
When privacyIDEA is the better architecture
Use privacyIDEA when many applications need one policy, when users already live in directory services, or when authentication must cover infrastructure as well as websites. Its integrations can place a second factor in front of SSH, VPN and RADIUS services, Linux PAM, Windows Credential Provider, Keycloak and custom applications through REST APIs. It also supports factors beyond OTP, including passkeys, FIDO2 devices, smartcards, push, SMS and email.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
A typical rollout is:
- Connect privacyIDEA to the authoritative identity store, such as LDAP, Active Directory, SQL or Entra ID.
- Define which groups and applications require which token types.
- Enroll users with TOTP, passkeys or hardware devices and issue recovery methods.
- Integrate each target service using its supported connector, such as PAM, RADIUS, Keycloak or an API.
- Test login, failure, revocation and offboarding paths before enforcing the policy for everyone.
Adding open-source 2FA to SSH, VPNs and Keycloak
SSH and Linux access
For Linux systems, privacyIDEA can integrate through PAM. Apply the policy to a test group first, keep an emergency administrative path protected, and verify that console or out-of-band access remains available if the MFA service is unreachable.
VPN and RADIUS
privacyIDEA documents RADIUS-based VPN integrations. Decide whether the VPN will accept TOTP, a FIDO2 credential or another supported token, then test expired codes, rejected attempts, revoked users and the behavior during a directory or MFA-server outage.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Keycloak and web portals
privacyIDEA supports identity-provider integrations such as Keycloak. Centralizing enrollment and policy can prevent every application from maintaining separate OTP seeds, but the trust relationship, token enrollment and recovery flow must be documented for administrators and users.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do you need a YubiKey?
No. A TOTP app can be adequate when a service does not support WebAuthn, when offline code generation is essential, or when you need broad compatibility. A FIDO2 security key such as a YubiKey is optional hardware for stronger phishing resistance and convenient possession-based authentication. privacyIDEA lists YubiKey among supported FIDO2/WebAuthn devices, and GitHub documents security keys, passkeys and WebAuthn as supported 2FA methods.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Hardware is most useful for administrator, VPN and other high-impact accounts. Enroll at least one backup authenticator and store it separately. A key does not replace recovery planning: losing every enrolled key and recovery method can permanently lock an account.
Security and recovery checklist
- Store TOTP/HOTP seeds in an access-controlled, encrypted database.
- Serve enrollment and login pages over HTTPS.
- Reject a previously accepted OTP and throttle repeated guesses.
- Use separate vaults or clearly separated roles for different users and administrators.
- Provide recovery codes or a second enrolled factor before enforcing 2FA.
- Back up the seed database and test restoration; protect backup copies as credentials.
- Document onboarding, factor replacement, revocation and employee offboarding.
- Keep an offline or out-of-band administrative recovery path for self-hosted infrastructure.
- Check browser and platform support before relying on WebAuthn PRF-wrapped storage.
A practical choice for common situations
- One person, several accounts: use a reputable local TOTP authenticator; choose 2FAuth if you specifically want a self-hosted web vault.
- Small team sharing administration: use isolated 2FAuth vaults, audit logs and explicit onboarding/offboarding controls.
- Many users and systems: evaluate privacyIDEA as the policy and integration layer.
- New application development: prefer WebAuthn/passkeys where your clients support them, and add TOTP as a carefully protected fallback when necessary.
- Phishing-sensitive administrator access: add FIDO2 security keys, enroll a spare and retain tested recovery codes.
Open-source 2FA is therefore a design decision: select the smallest component that meets your scope, use WebAuthn when phishing resistance matters most, retain TOTP where offline portability is valuable, and make recovery and seed protection part of the initial deployment rather than an afterthought.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
