A web-based 2FA authenticator — no app to install, ever
BAYAuth is a private, cloud-synced authenticator that runs in any browser — Windows, Mac, Linux, or phone. Your two-factor secrets are encrypted on your device before anything is uploaded — so the server holds ciphertext it has no key for, and your codes still follow you to every device you sign in from.
Free to use · Import from Google Authenticator · Works on any modern browser
How it works
Four steps, and your secrets never leave your device unencrypted
- Step 1
Create your vault
Choose a master password. It is stretched into an encryption key on your device and never sent to us. You also get a recovery key, generated locally.
- Step 2
Add your accounts
Scan a QR code, upload a screenshot, type a setup key, or bring everything across from Google Authenticator in one step.
- Step 3
Encrypted, then synced
Your vault is sealed with AES-256-GCM in your browser. Only the ciphertext is uploaded, so syncing never exposes a secret.
- Step 4
Open it anywhere
Sign in on another device, unlock with your master password, and your accounts are there — generating codes locally, as always.
Security architecture
What the server can and cannot see
The honest version, because a security product that is vague about its own model is not worth trusting.
Stays on your device
- Your master password. It is never transmitted — the browser derives a separate verifier to prove you know it.
- Your recovery key, generated locally and shown to you once.
- The key that decrypts your vault.
- Every TOTP secret, in readable form.
- The codes themselves. They are computed here, from the decrypted secret.
- QR images and Google Authenticator export payloads. Decoded in the page, never uploaded.
What we store
- Your email address, and a name if you gave one.
- An Argon2id hash of a value derived from your password — enough to check you know it, not enough to decrypt anything.
- Your encrypted vault, as an opaque blob.
- Your vault key, wrapped under keys we cannot derive.
- Session records, device labels, and a salted hash of your IP address.
- Security events, such as sign-ins and vault updates — never their contents.
The limit of browser-based encryption
We serve the JavaScript that does the encrypting. A compromised build pipeline could, in principle, ship code that behaves differently — and no amount of client-side cryptography prevents that, here or in any comparable web app. We reduce that risk with a strict Content Security Policy, almost no third-party JavaScript, pinned dependencies and a locked lockfile. We do not claim it is eliminated, and BAYAuth has not had an independent security audit. If your threat model includes a hostile provider, a native app with a verifiable binary is a better fit.
Features
Built to be used every day
Codes in one tap
Large, legible digits with a live countdown and a thumb-sized copy button. Codes refresh locally every second, with no round trip.
Real multi-device sync
Encrypted sync with conflict detection. If two devices edit at once, you are told — nothing is silently overwritten.
Passkeys for sign-in
Sign in with a passkey instead of typing your email and password. Your vault still unlocks separately, by design.
Clock drift handled
A skewed device clock silently breaks TOTP. We measure the offset and correct for it, so your codes are accepted.
Recovery you control
A recovery key only you hold. There is no administrative override and no master key on our side — which is the point.
Encrypted export
Download your vault as an encrypted file whenever you like. Your data is yours, and it is not held hostage.
Bring everything across from Google Authenticator
Google Authenticator can export all of your accounts as a QR code. Scan it with your camera, or just upload a screenshot — we read it in your browser, show you exactly what was found, and let you choose what to keep.
- Every account on the export code, in one pass.
- A review step before anything is saved, so you stay in control.
- Accounts already in your vault are detected, so re-importing is safe.
- Anything that cannot come across is listed with the reason why.
What happens to your export code
QR code
Camera frame or screenshot
Decoded in your browser
The image never leaves the page
Accounts extracted
Parsed and checked locally
You review and choose
Nothing is saved until you confirm
Encrypted on your device
AES-256-GCM, with your key
Ciphertext uploaded
The only thing we ever receive
Privacy
No tracking, no profiling, no analytics
There is no analytics script on this site. No third-party tag manager, no session recorder, no advertising pixel. Nothing on the page reports what you do to anyone.
That is not only a preference — it is a requirement of the architecture. Your issuer names, account names, TOTP secrets and generated codes exist in your browser in readable form. Any script with access to the page would have access to all of it, so we do not load scripts we do not control.
We do not store raw IP addresses. Where we need to recognise repeat activity — rate limiting, and the device list — we store a salted hash instead, and no device fingerprint is collected.
Related reading
Coming from a search about authenticator apps?
Google Authenticator on PC — every method compared
Emulators, browser extensions, downloadable desktop apps, and why a real web app skips all three problems.
BAYAuth vs. Google Authenticator, Authy, and Microsoft Authenticator
A direct, row-by-row comparison — sync, platforms, recovery, and what each one does when you lose your phone.
FAQ
Questions worth answering directly
What happens if I forget my master password?
You use your recovery key, which unlocks the same vault. If you have lost both, your vault cannot be decrypted — not by you, and not by us. We hold no key capable of opening it and there is no administrative override. That is what makes the encryption meaningful, and it is why the recovery key is worth storing carefully.
How is this different from Google Authenticator?
Google Authenticator keeps codes on one device, with an opt-in cloud backup, and has no official app for Windows, Mac, or a browser. BAYAuth is a vault that syncs by design and runs anywhere a browser does: sign in on any device and your accounts are there, while the secrets stay encrypted with a key only you have. See the full comparison on the alternatives page.
Can I use this on Windows or Mac without installing anything?
Yes — that is the point. There is no desktop app, browser extension, or emulator to install. Open the site in any modern browser on Windows, macOS, Linux, or Chrome OS, sign in, and your codes are there. The dedicated guide covers the common workarounds people use for Google Authenticator on a PC and why a real web app avoids all of them.
Can you see my 2FA secrets?
No. They are encrypted with AES-256-GCM in your browser before upload, under a key derived from your master password. We store the ciphertext and a wrapped copy of your vault key, neither of which we can unwrap. The caveat worth knowing is that we serve the JavaScript doing the encrypting — see the security section above, where we set that out rather than glossing over it.
Do you support 8-digit codes, SHA-256, or unusual refresh periods?
Yes. SHA-1, SHA-256 and SHA-512 are supported, with 6, 7 or 8 digits and any refresh period. The engine is tested against the official RFC 6238 test vectors for all three hash algorithms.
What about HOTP, the counter-based kind?
Not yet. HOTP codes advance on a counter rather than a clock, so they cannot be generated correctly from time alone. When we detect an HOTP account we tell you plainly and skip it, rather than importing it as a time-based account that would silently produce wrong codes.
Is a passkey the same as my vault password?
No, and keeping them separate is deliberate. A passkey proves who you are to the server. Your master password derives the key that decrypts your vault. Signing in with a passkey therefore does not, on its own, decrypt anything — your vault still unlocks separately.
Can I get my data out?
Any time. You can download your vault as an encrypted file, which you can keep as a backup. Your accounts can also be shown as QR codes individually, so you can move them into any other authenticator app.
Has this been independently audited?
No. It has not had a third-party security audit, and we will not imply otherwise. The design, the threat model and its known limitations are documented in the repository so you can judge it for yourself, or have someone else do so.
Keep your 2FA codes without giving them away
Set up a vault in about a minute. Bring your accounts over from Google Authenticator, and keep them encrypted with a key that stays with you.
Create your vault