Fact-checked by Grok 2 weeks ago

FreeOTP

FreeOTP is a free and open-source mobile application designed for two-factor authentication, enabling users to generate one-time passwords on their devices to secure online accounts. It implements the HOTP (HMAC-based one-time password, RFC 4226) and TOTP (time-based one-time password, RFC 6238) protocols, allowing compatibility with any server-side system that supports these open standards without requiring proprietary components. Tokens are added by scanning QR codes provided by services, providing a simple setup process for enhanced security on platforms like , , , and others. Developed by as part of the , FreeOTP began development in August 2013 as a fresh rewrite incorporating some code from , with its initial public announcement following shortly thereafter. The project is licensed under the Apache 2.0 License and is maintained through open-source contributions on , with separate repositories for its Android and iOS implementations involving around 28 contributors. Key features include support for scanning via the device's camera (optional permission), offline operation for password generation, and no need for beyond initial setup, emphasizing and security without data collection. FreeOTP is available on the Google Play Store for Android devices and the Apple App Store for iOS, as well as through F-Droid for open-source enthusiasts. While the official versions receive periodic updates, community forks like FreeOTP+ extend functionality with features such as backup and restore options, though the core app remains focused on reliability and minimalism. As of 2025, the latest stable release for Android is version 2.0.5, ensuring ongoing support for modern mobile operating systems.

History and Development

Origins and Initial Release

FreeOTP was developed by in 2013 as an open-source alternative to two-factor (2FA) applications, particularly in response to becoming closed-source that year. The project was initiated in August 2013 by engineer Nathaniel McCallum to fill the gap in free and open-source mobile tools for generating one-time passwords compatible with established IETF standards. The initial public release for occurred on October 24, 2013, as version 1.0, making it available via and shortly thereafter. The version followed later, with its 1.0 release on May 13, 2014. Early development focused on implementing the HOTP algorithm defined in RFC 4226 and the TOTP algorithm in RFC 6238, ensuring compatibility with any server-side components adhering to these open protocols without reliance on . The project's source code was initially hosted on Fedora Hosted at fedorahosted.org/freeotp under the Apache 2.0 license. It was later migrated to , where the and repositories continue to be maintained.

Maintenance and Community Contributions

FreeOTP has been licensed under the Apache License 2.0 since its inception, a permissive that facilitates contributions by allowing broad reuse and modification of the code while requiring attribution. This licensing model has encouraged community involvement, with the official project website explicitly stating that pull requests are welcome on . The project's repositories were migrated to GitHub under the freeotp organization following the retirement of the original Fedora Hosted platform in March 2017, improving accessibility and collaboration tools for developers. Post-migration, maintenance has been primarily handled by Red Hat engineers, who sponsor the project and oversee official releases, though external contributions via pull requests are accepted under the Apache License 2.0. Key updates have focused on stability and compatibility rather than major feature additions. The Android version reached 2.0.5 on January 17, 2025, incorporating minor UI tweaks such as vector drawable icons for editing and margin adjustments to prevent content cutoff, alongside updates for Android 14 compatibility and dependency refreshes. Similarly, the iOS version advanced to 2.3.5 on May 20, 2024, addressing bug fixes including invalid image parameter crashes and font integrations for enhanced reliability. Due to the pace of official updates, community-driven forks have emerged to extend functionality. For instance, FreeOTP+ is an enhanced fork of the implementation that introduces backup and restore features via or other providers, along with biometric and a search bar, motivated by the need for more active development on user-requested enhancements.

Features and Functionality

Core Authentication Capabilities

FreeOTP enables users to add authentication tokens primarily through scanning QR codes with the device's camera, which encodes the necessary details such as the secret key, issuer, and algorithm in a format compliant with standards like otpauth:// schemes. For services without support, manual entry is available, allowing users to input the secret key (typically in format), issuer name, algorithm (e.g., ), digits (6 or 8), and interval (30 seconds for TOTP). This process ensures compatibility with a wide range of two-factor providers without requiring extensions. Once added, FreeOTP generates one-time passwords (OTPs) locally on the device, displaying them as 6- or 8-digit numeric codes that users enter during . For (TOTP) tokens, these codes refresh automatically every 30 seconds based on the device's clock, while (HOTP) tokens advance on demand. The app supports storing multiple tokens in a single interface, each organized by the issuer name for quick identification and access. All OTP generation occurs offline after initial setup, relying solely on the stored secrets and device time without needing an internet connection. To enhance , users can optionally protect with a device PIN, though this is configured through platform settings rather than app-specific options.

User Management and Security Options

FreeOTP provides users with straightforward options for securing to the application itself, primarily through with the device's native mechanisms rather than a standalone app-specific PIN. On , the supports biometric via hardware to protect , aligning with the platform's . Similarly, the iOS version allows users to enable a device unlock requirement for individual tokens, indicated by a , ensuring that biometric or passcode verification is needed before codes can be viewed or generated. Tokens in FreeOTP are stored exclusively in local, encrypted storage on the device. Official releases do not support cloud synchronization, but since version 2.0 for Android (January 2023), include local encrypted backup and restore functionality via the device's KeyStore, with updates in v2.0.5 (January 2025) addressing restore issues such as overwriting the master key for better compatibility with Android 14. On iOS, tokens are included in device backups (iCloud or iTunes/Finder) if enabled, requiring Advanced Data Protection for secure restoration on new devices. This design keeps sensitive data under direct device control and minimizes exposure to remote breaches, though users should test backup and restore processes due to reported reliability issues, particularly on Android where intermittent failures or corrupt backups have been noted as of 2024. For organizing stored tokens, FreeOTP enables basic individual management actions, including renaming labels for better identification, reordering entries via drag-and-drop or list adjustments, and deleting specific tokens when no longer needed. On , deletion is facilitated by swiping left on a token entry to reveal a remove option, while uses long-press or menu selections for similar operations. These features allow users to maintain a clean, personalized list without affecting the offline generation of one-time passwords. Since , the core app provides export and import functionality for tokens through encrypted backups, enhancing migration between devices while maintaining security against bulk extraction in case of ; however, this is limited to local operations without .

Technical Implementation

Supported Protocols and Standards

FreeOTP supports the (HOTP) algorithm as defined in RFC 4226, which is an event-based method for generating one-time passwords. In HOTP, a key (typically 128 to 160 bits in length) and an incrementing 8-byte counter are used to produce a 160-bit hash via the HMAC-SHA-1 function. This hash is then truncated using a dynamic to yield a 31-bit value, which is converted to a decimal OTP of 6 to 8 digits by taking the value modulo 10 raised to the power of the digit length. Building on HOTP, FreeOTP also implements the Time-based One-Time Password (TOTP) algorithm per RFC 6238, which replaces the event counter with a time-based counter derived from the current Unix timestamp. Specifically, the counter is calculated as the floor of (current Unix time minus a reference timestamp, defaulting to the Unix epoch) divided by a time step interval of 30 seconds, ensuring OTPs are valid for short windows to enhance security. TOTP in FreeOTP retains the same HMAC-SHA-1 hashing, truncation, and digit length mechanisms as HOTP, with shared secrets up to 160 bits. These implementations ensure broad , as FreeOTP generates OTPs compatible with any standards-compliant server supporting 4226 or 6238, avoiding and promoting use across diverse systems. Tokens are typically provisioned by scanning a containing the secret key and parameters.

Platform-Specific Adaptations

FreeOTP's implementation is tailored to the native capabilities of and , ensuring seamless integration with each platform's APIs while maintaining core functionality for one-time password generation based on HOTP and TOTP standards. On , FreeOTP leverages the Android Camera API to enable scanning for adding authentication tokens, requiring the camera permission only when this feature is used. The app does not require internet permissions for its primary operations, as token generation occurs offline; any is limited to optional fetching of token icons. This design enhances privacy, making it compatible with , a repository focused on distribution without proprietary trackers. For , FreeOTP integrates with the iOS Camera framework to support scanning, where users must grant camera access via device settings. Secrets for tokens are securely stored using the , which provides hardware-backed encryption. Additionally, the app supports biometric authentication through integration with the device's Secure Enclave, allowing unlock via or for protected tokens. Cross-platform consistency is achieved through shared logic for HOTP and TOTP protocol handling, despite development in separate repositories—FreeOTP-Android (in ) and FreeOTP-iOS (in )—to optimize for each operating system's native environment. The lightweight architecture minimizes resource usage, with periodic TOTP refreshes designed to have negligible impact on battery life due to efficient, on-device computation.

Availability and Distribution

Android Implementation

FreeOTP for Android traces its release history back to version 1.0 in late 2013, marking the initial public availability of the application as an open-source two-factor authentication tool developed by Red Hat. Subsequent updates addressed usability, security, and platform evolution, culminating in version 2.0.5 released on January 17, 2025, which incorporates enhancements for compatibility with Android 14 (API level 34) and newer versions, including dependency updates and UI optimizations. The application is distributed across several reputable channels to accommodate varying user needs regarding convenience and source verification. On the Google Play Store, users can install it directly with automatic updates, ensuring broad accessibility for standard devices. For those prioritizing fully open-source builds without proprietary components, FreeOTP is available through , where version 2.0.4 was added on June 17, 2024. Advanced users or those seeking the most recent releases can download files straight from the official repository, which hosts signed builds for manual . The latest version (2.0.5) requires 6.0 ( level 23) or higher for installation and optimal performance on modern devices. Earlier versions supported 4.0 ( level 14), but current releases have raised the minimum SDK to align with updated dependencies and security features. The app maintains a privacy-focused approach with limited permissions: camera access is optional and solely for scanning during token setup, while storage permissions enable secure handling and of . In line with its support for standard protocols like HOTP and TOTP, the Android implementation leverages platform-specific features for seamless token management.

iOS Implementation

FreeOTP's iOS implementation debuted in late 2013 with version 1.0, offering users a dedicated authenticator app for generating time-based one-time passwords (TOTP) and HMAC-based one-time passwords (HOTP) directly on Apple devices. Developed by , the initial release focused on seamless integration with services supporting standard protocols, allowing token setup via scanning for quick adoption in enterprise and personal security workflows. Over the years, the has evolved through regular updates to maintain compatibility with advancing versions and address emerging concerns. The progression from early versions like 1.2 in 2019, which included improvements and support, to more recent releases demonstrates ongoing maintenance. The current stable version, 2.3.5, was issued on May 20, 2024, incorporating fixes for crashes related to invalid image parameters and enhancements for and later, including refined handling of photo library permissions to comply with Apple's stricter guidelines. Exclusively distributed through the Apple under the name FreeOTP (app ID 872559395), the underscores a commitment to channels, with no provisions or emphasis on methods typical of ecosystem restrictions. This distribution model ensures automatic updates and adherence to Apple's security standards, making it accessible via a simple search or direct link without requiring alternative installation paths. Compatibility is specified for and newer, encompassing , (with ), and devices, though recent updates optimize performance on hardware like series. For token enrollment, the app leverages Apple's AVFoundation framework to enable efficient scanning from the camera, streamlining the process of importing secrets from services like or without third-party dependencies.

Reception and Comparisons

User Feedback and Criticisms

FreeOTP has received mixed user feedback, with average ratings of 3.2 out of 5 on based on 5,486 reviews and 3.2 out of 5 on the from 166 reviews as of 2025. Users frequently praise FreeOTP for its open-source nature, which allows transparency and community contributions without proprietary restrictions. The app's simplicity is another common highlight, offering a straightforward interface for generating two-factor authentication (2FA) codes without unnecessary features that could complicate usage. Its reliability for basic 2FA tasks is appreciated, particularly the offline mode that enables code generation without connectivity, ensuring accessibility in various scenarios. Additionally, the absence of advertisements or data tracking aligns with privacy-conscious users' preferences, distinguishing it from more commercial alternatives. Criticisms often center on the lack of built-in or functionality, which poses a significant of if a device is lost or replaced, forcing users to manually reconfigure . The bare-bones , while simple, is seen by some as overly minimalistic, lacking intuitive elements like searchable token lists or customizable themes that enhance in larger collections. Infrequent updates have also drawn complaints, leading to occasional issues with newer operating system versions or evolving 2FA standards on certain services. Specific user feedback underscores appreciation for the offline capabilities but highlights challenges in migration, as the absence of sync or easy options makes transferring to a new device more cumbersome compared to s with automated synchronization. Some community-developed forks have emerged to address these limitations, providing enhanced features while maintaining the core open-source ethos.

Alternatives and Forks

FreeOTP, an open-source two-factor authentication (2FA) app emphasizing simplicity and compliance with standards like TOTP and HOTP, faces competition from several popular alternatives that offer varying degrees of additional functionality, particularly in and cross-platform support. Among these, is a app developed by , providing cloud-based backups tied to a for easy device transfers, though this raises privacy concerns due to data collection practices and lack of for backups. In contrast, Authy, owned by , supports seamless cloud synchronization across multiple devices and platforms, enabling multi-device usage without manual exports, but it requires a phone number for setup and is not open-source. Other open-source options include Authenticator, which is Android-exclusive and features robust export capabilities for encrypted backups, allowing users to secure their tokens offline without relying on cloud services. Similarly, 2FAS offers open-source support for both Android and , along with browser extensions for autofill integration, enhancing usability for web-based logins while maintaining minimal data collection. FreeOTP stands out for its minimalist design and strict adherence to open standards without unnecessary features, making it lightweight and secure for basic 2FA needs, but it falls short in built-in backup options compared to Authy or , which provide more flexible recovery mechanisms. Notable forks of FreeOTP include FreeOTP+, a maintained enhancement that adds encrypted functionality, as well as improved with other apps through formats, and is available via the Store. In the market, FreeOTP and its derivatives are often recommended for privacy-conscious users seeking to avoid proprietary ecosystems like those of or Apple, prioritizing local storage and open-source transparency over advanced syncing features.

References

  1. [1]
    FreeOTP
    FreeOTP is a two-factor authentication application for systems utilizing one-time password protocols. Tokens can be added easily by scanning a QR code.
  2. [2]
    freeotp/freeotp-android - GitHub
    FreeOTP is a two-factor authentication application for systems utilizing one-time password protocols. Tokens can be added easily by scanning a QR code.Issues 131 · Actions · Security
  3. [3]
    FreeOTP Authenticator - Apps on Google Play
    ### Summary of Core Features
  4. [4]
    FreeOTP multi-factor authentication - LWN.net
    Jan 22, 2014 · FreeOTP was started in August 2013; although it includes bits of code from Google Authenticator, it is predominantly a fresh rewrite—albeit one ...
  5. [5]
    freeOTP - an open source solution for authentication soft tokens
    Jun 25, 2014 · FreeOTP can currently be used for services utilising the HTOP and TOTP one-time password protocols, and also supports adding a new soft token ...
  6. [6]
    FreeOTP Authenticator - Download
    FreeOTP Authenticator can be used with any service that supports the TOTP or HOTP two-factor authentication method. Is FreeOTP Authenticator open-source? Yes, ...<|control11|><|separator|>
  7. [7]
    Release v1.0 · freeotp/freeotp-android
    - **Release Date:** 24 Oct
  8. [8]
    FreeOTP Authenticator - App Store - Apple
    Rating 3.2 (166) · Free · iOSFreeOTP adds a second layer of security for your online accounts. This works by generating one-time passwords on your mobile devices.
  9. [9]
    https://github.com/freeotp/freeotp-android/blob/master/COPYING
  10. [10]
    https://github.com/freeotp/freeotp-android/releases/tag/v2.0.5
  11. [11]
    https://github.com/freeotp/freeotp-ios/releases/tag/v2.3.5
  12. [12]
    helloworld1/FreeOTPPlus: Enhanced fork of FreeOTP ... - GitHub
    FreeOTP Plus forked the same functionality of FreeOTP provided by RedHat with the following enhancement: Export settings to Google Drive or other document ...
  13. [13]
    QR code vs manual setup #209 - freeotp/freeotp-android - GitHub
    Mar 5, 2019 · To display the 2FA code, you need to press once on the '------' beside the site name of your 2FA entry on Free OTP, and they will become the displayed 2FA code ...
  14. [14]
    lock app / require pin on open #347 - freeotp/freeotp-android - GitHub
    Aug 5, 2023 · The benefit of prompting for the device credential rather than a custom pin is that the freeotp unlock code will be in lock step with the ...Missing: management storage
  15. [15]
    FreeOTP | F-Droid - Free and Open Source Android App Repository
    ### Summary of FreeOTP Features
  16. [16]
    Look at the icon · Issue #224 · freeotp/freeotp-ios - GitHub
    Jan 13, 2021 · When you add a token, you have the option to require you to unlock the phone to activate the token. If I enable this, there's a small padlock on the icon.Missing: management storage
  17. [17]
    The best authenticator apps for Android, iOS, Windows, and macOS
    Jan 7, 2022 · FreeOTP's final advantage is that it takes up minimal storage space, about 2MB–3МB (by comparison, Google Authenticator requires 15MB–20MB, and ...
  18. [18]
    The Ultimate Guide to Choosing the Best Authenticator App For 2025
    Mar 20, 2025 · Key Features: Local-only storage with encrypted vault; Backup/export with user-managed encryption; Biometric/PIN lock; Open-source and actively ...
  19. [19]
    Can't delete old or wrong token · Issue #220 · freeotp ... - GitHub
    Dec 18, 2020 · You can indeed "delete" tokens from your Keychain quiet easily. Simply swipe left on any token and a menu will popup at the bottom of the display allowing one ...Missing: management | Show results with:management
  20. [20]
    Deleting token in FreeOTP · Issue #238 - GitHub
    Hello, how can I delete a token in FreeOTP which I do not need anymore? Thanks! Kind regards.Missing: management | Show results with:management
  21. [21]
    Why is import/export still suggested when it doesn't work? · Issue #395
    Feb 14, 2024 · I had installed FreeOTP on a new phone a month ago. Had to do a reset now, exported keys, wanted to import after the reset. It doesn't work.Missing: PIN lock storage
  22. [22]
    FreeOTP ignores a critical known issue with backup and restore - Apps
    Aug 31, 2024 · The app currently has a backup feature, but it's not possible to restore from the backup, and some of them seem to even be corrupt.Missing: date | Show results with:date
  23. [23]
    RFC 4226: HOTP: An HMAC-Based One-Time Password Algorithm
    ### Summary of HOTP Algorithm (RFC 4226)
  24. [24]
    RFC 6238 - TOTP: Time-Based One-Time Password Algorithm
    This document describes an extension of the One-Time Password (OTP) algorithm, namely the HMAC-based One-Time Password (HOTP) algorithm, as defined in RFC 4226.
  25. [25]
    freeotp/freeotp-ios - GitHub
    FreeOTP is a two-factor authentication application for systems utilizing one-time password protocols. Tokens can be added easily by scanning a QR code.
  26. [26]
    Privacy Policy - FreeOTP
    FreeOTP does not collect any data from your mobile device. Camera access is used only for scanning OTP QR codes. Internet access is used only for fetching token ...Missing: API | Show results with:API
  27. [27]
    Free OTP app not working on IOS12.1 · Issue #112 - GitHub
    Nov 30, 2018 · Whenever I try to scan a bar code with freeOTP app it just blanks out and I am not able to get the OTP. I use this in conjunction to RedHat ...Missing: red hat initial
  28. [28]
    Unlocking biometric tokens · Issue #385 - GitHub
    Dec 30, 2024 · Hi,. This functionality does not exist currently. When tokens are added to FreeOTP they are added into the device Apple Keystore which sets the ...
  29. [29]
    FreeOTP - GitHub
    FreeOTP has 7 repositories available. Follow their code on GitHub.
  30. [30]
    FreeOTP | F-Droid - Free and Open Source Android App Repository
    FreeOTP is a two-factor authentication (2FA) application for systems utilizing one-time password protocols (OTP).Missing: initial | Show results with:initial
  31. [31]
    Releases · freeotp/freeotp-android
    - **Earliest Release Date and Version**:
  32. [32]
    https://github.com/freeotp/freeotp-android/releases
  33. [33]
    https://github.com/freeotp/freeotp-ios/releases/tag/v2.3.1
  34. [34]
    FreeOTP Authenticator - Apps on Google Play
    Rating 3.2 (5,486) · Free · AndroidFreeOTP adds a second layer of security for your online accounts. This works by generating one-time passwords on your mobile devices.
  35. [35]
    FreeOTP (Authenticator) - Review
    Rating 3.5 · Review by Kelson VibberJul 1, 2025 · Available from Play Store, F-Droid, App Store. Reviewed by Kelson Vibber on July 1, 2025 . Tagged: 2FA · Android · Authenticator · Degoogling · ...<|control11|><|separator|>
  36. [36]
    FreeOTP+ (2FA Authenticator) - Apps on Google Play
    Rating 4.3 (474) · Free · AndroidFreeOTP+ is an free and open-sourced 2FA autenticator forked from the original FreeOTP with additional feature to help backup, restore and interoperate with ...
  37. [37]
    The Best Two-Factor Authentication App - The New York Times
    Feb 18, 2025 · Duo Mobile is free and easy to use, with a simple, uncluttered interface. If you're new to 2FA, this app is a good way to get started.
  38. [38]
    Aegis Authenticator - 2FA App - Apps on Google Play
    Rating 4.5 (5,531) · Free · AndroidAegis Authenticator is a free, secure and open source app to manage your 2-step verification tokens for your online services.
  39. [39]
    The Best Authenticator Apps for 2025 - PCMag
    Our Editors' Choice winners in this category are 2FAS and Aegis Authenticator because they're easy to set up and don't require much personal data.
  40. [40]
    Great FreeOTP Alternatives: Top Authenticators in 2025 - AlternativeTo
    Oct 20, 2025 · Other great apps like FreeOTP are KeePass, Ente Auth, Proton Authenticator and Bitwarden Authenticator. FreeOTP is a two-factor authentication ...