SelfHostAuth

Spec sheet

Purpose

SelfHostAuth is an open-source, self-hosted TOTP/HOTP authenticator and sync server.Read 9 Oct 2026 · github.com

Audience

The README identifies homelabbers, privacy advocates, teams needing a self-hosted OTP server, and people seeking alternatives to Google Authenticator or Authy as its intended users.Read 9 Oct 2026 · github.com

Deployment

The server uses Node.js 22+ and SQLite and can run with Docker Compose, systemd, or bare metal on a home server, NAS, Raspberry Pi, or VPS.Read 9 Oct 2026 · github.com

Free plan

YesRead 21 Sep 2026 · github.com

Integrations

It accepts otpauth:// imports and provides a typed TypeScript API client for its sync server.Read 9 Oct 2026 · github.com

Security

The server encrypts vault items at rest with AES-256-GCM, hashes passwords with scrypt and session tokens with SHA-256, and supports optional account TOTP authentication.Read 9 Oct 2026 · github.com

License

The repository is licensed under MIT.Read 9 Oct 2026 · github.com

Availability limit

The project says there is no hosted version and it is self-hosted only by design.Read 9 Oct 2026 · github.com

Clients

The project lists a web vault, Windows/macOS/Linux Electron desktop apps, iOS and Android apps, and Chrome/Edge/Firefox browser extensions.Read 9 Oct 2026 · github.com

Code standards

It supports RFC 4226 and RFC 6238, SHA-1, SHA-256, and SHA-512, 6–8 digits, and configurable periods.Read 9 Oct 2026 · github.com

Code type

totp and hotpRead 21 Sep 2026 · github.com

Imports

Users can add accounts by scanning or pasting a QR code, an otpauth:// URI, or a raw base32 secret.Read 9 Oct 2026 · github.com

Multi-device sync

YesRead 21 Sep 2026 · github.com

Offline use

Clients cache the vault locally and compute TOTP codes without connecting to the server.Read 9 Oct 2026 · github.com

Push approvals

NoRead 21 Sep 2026 · github.com

Security disclosures

The vulnerability report last checked on 2026-09-28 lists one high and one medium finding, including a pnpm audit summary of 24 vulnerabilities.Read 9 Oct 2026 · github.com

Support policy

The security policy says maintainers aim to acknowledge vulnerability reports within three business days and ship a fix or mitigation within 30 days for high-severity issues.Read 9 Oct 2026 · github.com

Supported platforms

web,windows,macos,linux,ios,android,chrome_extensionRead 21 Sep 2026 · github.com

Sync

Revision-based push/pull sync uses last-write-wins and tombstones so deleting a code on one device deletes it across devices.Read 9 Oct 2026 · github.com

Transport

The project says to use TLS through a reverse proxy; HTTPS is required for mobile apps and browser extensions when connecting outside localhost.Read 9 Oct 2026 · github.com

Plans and prices

Every SelfHostAuth plan and price →

Where Specifiction places it

• Authenticator apps#25 of 1118.4