Gilos Authenticator

Your keys. Your device. Your control.

Gilos Authenticator is a free, open-source two-factor authentication app that keeps your accounts secure with time-based one-time passwords (TOTP). Built as the official companion to Gilos Auth, it works with any service that supports standard TOTP — Google, GitHub, Discord, and thousands more.

Available for Android and iOS.

Get it on Google Play View on GitHub

Why Gilos Authenticator?

Most authenticator apps store your codes only on one device. Lose your phone, lose your codes. Others sync through third-party clouds you don't control.

Gilos Authenticator is different. Your TOTPs are encrypted and synced through your own Gilos Auth account — an open-source identity server you can self-host or use our managed instance. No third-party cloud. No vendor lock-in. Full transparency.

Features

Secure by Design

  • Hardware-backed storage Secrets are stored in Android Keystore and iOS Keychain, not in plain app data
  • End-to-end sync TOTPs sync securely through the Gilos Auth backend with encrypted transport
  • Offline-first Codes generate locally without internet. Changes queue up and sync automatically when you're back online
  • Open source Fully auditable code. No tracking, no analytics, no telemetry

Effortless Setup

  • QR code scanning Point your camera at any TOTP QR code to add it instantly
  • Deep link support Tap otpauth:// links from browsers or other apps to add TOTPs directly
  • Cloud sync Sign in on a new device and your TOTPs are already there

Full Account Management

  • Session control View all active sessions and terminate any you don't recognize
  • Profile management Update your name, email, phone, avatar, and username right from the app
  • Multi-factor auth Enable TOTP, email, or phone-based MFA on your Gilos account itself
  • Browserless OAuth Approve third-party app authorizations directly in-app via deep links, no browser needed

Polished Experience

  • Material 3 design Clean, modern interface with attention to detail
  • Dark & light themes Follows your system preference, or set it manually
  • Live countdown timers Visual progress rings show exactly when each code expires
  • Copy with a tap One-tap clipboard copy for quick logins

How It Works

1

Sign in

with your Gilos Auth account (or create one at auth.gilos.org)

2

Add TOTPs

by scanning QR codes or entering secrets manually

3

Use your codes

to log in to any service that supports 2FA

4

Sync automatically

Your TOTPs sync automatically across all your devices

Gilos Authenticator implements the standard TOTP algorithm (RFC 6238) — the same one used by Google Authenticator, Authy, and every other compliant authenticator app. Any service that gives you a QR code for 2FA works with Gilos Authenticator.

Security

What we store and where

DataStorageLocation
TOTP secretsEncrypted hardware keystoreDevice only (synced encrypted)
Access tokensFlutterSecureStorageAndroid Keystore / iOS Keychain
TOTP metadataSQLiteLocal app directory
Account infoCached JSONLocal app directory

Open source

The entire codebase is available on GitHub under the Apache License 2.0. The backend (Gilos Auth) is also open source. You can audit every line of code that touches your secrets.

Found a vulnerability? Please report it responsibly via our Security Policy.

What we never do

  • We never log secrets or tokens, even in debug builds
  • We never send analytics or telemetry to any third party
  • We never store TOTP secrets in plain text
  • We never require a Google, Apple, or Microsoft account

Download

Android

Available now on the Google Play Store.

Get it on Google Play

Or download the APK from GitHub Releases.

iOS

App Store release is coming soon.

Coming Soon

Build from source

git clone https://github.com/gilosorg/authenticator.git cd authenticator cp .env.example .env flutter pub get flutter run

Requires Flutter SDK 3.10.8 or later.

Works With Everything

Gilos Authenticator supports any service that uses standard TOTP (RFC 6238). Here are some popular ones:

Google GitHub GitLab Bitbucket Discord Slack Telegram AWS Azure DigitalOcean Cloudflare Binance Coinbase Kraken WordPress Joomla Drupal Bitwarden 1Password LastPass

+ Any service with a TOTP QR code

FAQ

Is Gilos Authenticator free?
Yes, completely free and open source. No premium tier, no ads, no in-app purchases.
Can I use it without a Gilos Auth account?
A Gilos Auth account is required for sign-in and cloud sync. You can create one for free at auth.gilos.org, or self-host your own Gilos Auth instance.
Can I self-host the backend?
Yes. The Gilos Auth server is open source. Deploy it on your own infrastructure for full control over your identity data.
What happens if I lose my phone?
Sign in on another device with your Gilos Auth account and your TOTPs sync automatically. No backup codes to manage.
Does it work without internet?
Yes. TOTP codes are generated entirely on your device using the locally stored secret. Internet is only needed for syncing changes across devices.
Can I import from Google Authenticator or Authy?
You can add any standard TOTP by scanning its QR code or entering the secret manually. Bulk import from other apps is planned for a future release.
Is it compatible with Google Authenticator QR codes?
Yes. Gilos Authenticator uses the standard otpauth:// URI format, which is the same format used by Google Authenticator and all compliant authenticator apps.

Links

Gilos Authenticator is developed by Gilos.
The Gilos name and logos are trademarks of CHERRY SOFTWARES LLC.