2faco for Android
The same 2faco TOTP engine from the browser extension, now as a native Android app. Codes sync across your devices via your Google account, with optional PIN protection.
⬇ Download 2faco for Android (.apk)
~2.8 MB · Signed release · No Google Play required
Install on Android
The app is distributed as an APK — no Google Play account needed. Android will warn you about installing from unknown sources; this is standard for apps installed outside the Play Store.
Download 2faco.apk using the button above, or open this page on your Android device and tap download.
When prompted, tap Open or Install. If Android blocks the install, tap Settings and enable Allow from this source for your browser or file manager, then go back and tap Install.
Open 2faco from your app drawer. Paste an otpauth:// URI or base32 secret to add your first account.
apksigner verify --print-certs 2faco.apk — the SHA-256 fingerprint should match 983248edde2edb93092e6df1a7ba76ebe5cc9a795e40400a21a22c72ebf69076.What you can do with it
Synced across devices
Your accounts sync via your Google account, so codes are available on every device — phone, tablet, and desktop (with the Chrome extension).
Optional PIN lock
Encrypt your secrets with a PIN (AES-256-GCM, key derived with PBKDF2-SHA256, 200k iterations). No PIN, no decryption.
One-tap copy
Every code shows with a live countdown bar. Tap a code to copy it to your clipboard — ready to paste into any login form.
Add by pasting
Paste any otpauth:// URI or base32 secret and name each key. Supports SHA-1/SHA-256/SHA-512, 6–8 digits and custom periods.
Groups & labels
Tag accounts with an optional group like “Work” — shown as a badge on each code and carried through export/import.
System, Light & Dark themes
A polished glassmorphism design. Follows your system theme by default, with a manual toggle.
Import & export
Backup all accounts to a secure JSON file. Restore on any device or after a fresh install.
Brute-force protection
PIN attempts are limited to 5, with a 5-minute lockout after max failures. Keeps your accounts safe.
Open standards
Built on RFC 6238 with the WebCrypto API. No external libraries, no analytics, no network calls.
Security & privacy
The Android app follows the same privacy-first approach as 2faco.com and the Chrome extension:
- No accounts, no servers. Secrets are stored locally on your device and synced via your Google account’s storage — never on 2faco infrastructure.
- Encrypted at rest (optional). With a PIN set, secrets are stored as AES-256-GCM ciphertext. The PIN is never stored — only a slow-hash verifier — so nobody, including us, can decrypt your secrets without it.
- No tracking. The app contains no analytics, no telemetry, and makes no network requests.
- Everything is local. Codes are generated on your device with the WebCrypto API.
Full details in the Privacy Policy.
Getting started
Add your first account by pasting an otpauth:// URI — most services show a QR code in their security settings; use the “can’t scan the QR code” link to reveal the URI or secret. The next time you log in, open 2faco and copy the code.
Troubleshooting
- Android blocks the install: go to Settings → Apps → Special app access → Install unknown apps and allow your browser or file manager to install apps. This is standard for APKs outside the Play Store.
- Codes don’t match your other device: your phone clock may be out of sync. Go to Settings → Date & time and enable Automatic date & time.
- Forgot your PIN: the PIN cannot be recovered. Clear the app’s data from Settings → Apps → 2faco → Storage and re-add your accounts.
- App not listed on Play Store: 2faco is distributed directly as an APK. Download it from this page — no Play Store account needed.
Version history
- 2.0.0 (latest) — 2faco.apk. Initial Android release. Capacitor 6 wrapper around the 2faco TOTP engine with glassmorphism design, sync, PIN encryption, groups, import/export, and system/light/dark themes.
Questions or feedback? Contact us.