How do I add my first account?
Tap the + button in the top-right corner. You can scan a QR
code from your computer screen, import a QR code saved as a photo, or enter
the secret key manually. Most services show a QR code on their
"Two-factor authentication setup" page.
Which services does Keya Authenticator work with?
Any service that supports the TOTP standard (RFC 6238) or HOTP standard
(RFC 4226). This includes Google, GitHub, Dropbox, Twitter/X, Amazon AWS,
Microsoft, Facebook, Apple ID, and hundreds more.
Does it work without an internet connection?
Yes — completely. TOTP codes are generated mathematically from your secret
and the current time. No network connection is ever needed, and the app has
no network entitlements at all.
Where are my secrets stored?
All 2FA secrets are stored in the iOS Keychain using
kSecAttrAccessibleWhenUnlockedThisDeviceOnly. This means they
are encrypted by the secure enclave, unavailable when the screen is locked,
and cannot be transferred to another device via backup.
What happens if I lose my phone?
Your codes are gone unless you have a backup. This is by
design — the strict Keychain protection that keeps your secrets safe also
means they cannot be silently copied. Use Settings → Export (Backup)
regularly and store the backup file somewhere safe (encrypted external drive,
password manager, etc.).
Is my PIN stored on the device?
Never in plaintext. Your PIN is hashed using PBKDF2-HMAC-SHA256 with
100,000 iterations and stored in the Keychain. The original PIN cannot be
recovered from the stored hash.
What is the biometric change detection?
Keya Authenticator records a fingerprint of the biometric database when you
set your PIN. If new fingerprints or Face ID scans are added to your device,
the app detects the change and disables biometric unlock as a security
precaution. You can re-enable it in Settings → App Lock
after confirming the change was made by you.
How do I transfer tokens to a new iPhone?
Go to Settings → Export (Backup) and create an encrypted
backup. Save the file to Files, AirDrop it to your new phone, then open ES
Authenticator on the new device and import the backup.
Alternatively, export individual tokens as QR codes and scan them on the
new device.
Can I import from Google Authenticator?
Yes. In Google Authenticator, go to Transfer accounts → Export accounts
and scan the QR code(s) with Keya Authenticator's import function. All tokens
will be imported in one step.
Which apps can I import from?
Keya Authenticator supports importing from:
- Google Authenticator (migration QR codes)
- Aegis (JSON export)
- 2FAS (JSON export)
- Raivo (JSON export)
- LastPass Authenticator
- Keya Authenticator encrypted or plaintext JSON backups
- Any plain
otpauth:// URI or QR code
Is the encrypted backup format open?
Yes. Backups use AES-256-GCM encryption with a PBKDF2-HMAC-SHA256 derived
key (100,000 iterations). The format is documented in the source code and
can be decrypted with any standard cryptographic tool given the password.