# Authme: a desktop 2FA vault with password-based AES 256bit encryption

> Authme is a Tauri desktop authenticator for Windows, Linux, macOS and the web that holds TOTP codes encrypted under a password you set, imports vaults from Google Authenticator, 2FAS and Aegis, and works fully offline. The trade-off is that it is a full vault owner, not a browser helper, so the risk moves to the desktop and to the .authme export file.

**Levminer/authme** — Simple cross-platform two-factor (2FA) authenticator app for desktop.

- Repository: https://github.com/Levminer/authme
- Website: https://authme.levminer.com
- Stars: 549 · Forks: 45
- Language: TypeScript
- License: GPL-3.0
- Published: 2026-10-22 · Updated: 2026-10-22 · Language: en
- Canonical page: https://hysenlabs.com/projects/levminer-authme

## A desktop vault for the codes that usually live in a browser

Authme is described in its repository as a simple cross-platform two-factor authenticator app for desktop, and the description is accurate about what it is not: there is no account system, no sync service and no server component in the description. It is a single local application that holds your one-time codes on the machine you run it on. The README states that the app is completely offline and that internet is only required for updates, which is the design decision that shapes everything else about it. Most browser-based authenticator extensions live inside a profile that gets copied, synced by the browser vendor and attached to a signed-in session. Authme deliberately sits outside that perimeter, as a native window on Windows, Linux, macOS and the web. That choice buys a clear boundary for the codes, and it hands you the job of backing up the boundary yourself.

## AES 256bit encryption bound to a password you set

The security claim in the README is narrow and specific: codes are secured by AES 256bit encryption with your own password. There is no account, no recovery email and no cloud key escrow described in the documentation, so the password is the only thing standing between a stolen vault file and your codes. That has an obvious upside, which is that nobody else holds a copy of that secret, and an obvious cost, which is that the documentation does not say what happens when the password is forgotten. No recovery flow, key escrow fallback or password reset path is described anywhere in the README. The README also does not document how the key is derived from the password, nor how long the vault takes to open. If password loss is a realistic scenario for you, that gap has to be closed by reading the app and its settings first.

## Four import routes, from a raw QR code to an Aegis vault

Import is where most migration friction lives, and Authme covers the common starting points. The supported types section lists TOTP, described as the QR code format found mostly everywhere 2FA is offered, with Google, Facebook and Microsoft given as examples. It also lists Google Authenticator, where you export all of your existing codes and import them into Authme. Two more explicit paths are named: creating a backup of all codes in 2FAS and importing that backup, and exporting a vault from Aegis and importing it. That covers the standard otpauth QR code plus three named vault formats. What is not documented is a command line importer, a scripted or unattended import mode, or a format for bulk accounts beyond these named ones, so large migrations are likely to be manual work done through the interface. The practical alternative to those apps is to stay inside one of them: 2FAS and Aegis each keep their own vault, and Authme's route into either one is described as taking a backup or a vault file, with the app described as working offline, so the documentation presents this as a one-time transfer rather than a connection between the two apps.

## Screen capture hiding and nine shipped languages

Two features stand out as being aimed at shared or public machines rather than at the code generation itself. The README states that Authme is hidden from video capture and screenshots, which is a different threat model from the encryption: it protects the visible code from a screen share or a recording tool, not the vault file from disk access. The second is language coverage, with the app available in English, Hungarian, Spanish, French, Russian, German, Chinese, Japanese and Polish. Translation work is organised through a GitHub issue referenced from the README, so the locale set is open to contributions rather than fixed by the maintainer alone. Neither feature is described in implementation detail, so there is no way to tell from the documentation whether the hiding is a window flag, an overlay, or something else, and whether every platform behaves the same way.

## Getting Authme onto Windows, Linux, macOS and the web

There are no installation commands in the documentation, and the README instead points to the project's own downloads page at authme.levminer.com, described as the place holding the latest release version for users that want a stable and polished experience. The README also lists distribution channels: the Microsoft Store, Snapcraft, winget and Scoop, and the feature list adds that the app is available on Windows, Linux, macOS and web. The web build matters for a 2FA app, because it offers a path for a machine where installing native software is inconvenient, and the same README warns implicitly that a browser-based vault is exposed to the browser trust boundary that the desktop build avoids. For a first run, the documented flow is the getting started wizard that appears after installation, followed by the codes page, where the Choose file control is used to select an imported .authme file.

## Building from source: Tauri, Svelte and Tailwind behind the window

The repository is written in TypeScript and built on Tauri, with the npm scripts in package.json showing how a contributor drives the app. The default branch is dev, and the package version is 7.1.1. The three scripts a reader would care about run the app in development, produce a release build, and run the static checks:

```json
	"dev": "node scripts/buildNumber.cjs alpha true && tauri dev",
	"build": "node scripts/buildNumber.cjs release false && tauri build",
	"check": "svelte-check && tsc --noEmit",
```

The interface itself is Svelte, with Tailwind, PostCSS and Svelte Preprocess in the development dependencies, and the check script combines svelte-check with the TypeScript compiler in no-emit mode. The top level of the repository splits into core, interface, website and scripts directories, with a separate website workspace defined in the workspaces array. The presence of a scripts/buildNumber.cjs step in front of both the dev and build scripts shows that build numbering is generated before the Tauri run. The README does not document the prerequisites for building, so a contributor is pointed at the CONTRIBUTING file in the .github directory instead.

## What Authme does not tell you before you move your codes

Several gaps matter more here than in a typical application. There is no documented automatic backup destination, no sync between the desktop and web builds, and no stated limit on how many codes the vault holds. There is also no mention of hardware key support, push based approval or any second factor type other than the four listed, and no description of how a TOTP secret is stored once inside the encrypted file. The migration tutorial shows the older upgrade path in detail: export the .authme file through Tools then Export, clear the data under File then Settings, uninstall, install the new version, go through the getting started wizard, and pick the saved file with Choose file on the codes page. That sequence is destructive by design, which means the export file is the only copy of those codes at that moment. Keep it until new codes have been generated and confirmed. Updates are the only network activity the README names, and it does not say whether the update check can be turned off, whether the packages are signed, or how the web build is kept current, so a locked-down workstation is worth checking in the settings.

## Licence terms and who to contact about business use

The project is licensed under GPL-3.0, with the licence text in the LICENSE.md file at the repository root. The README adds a specific note that is easy to skim past: if you are planning to use the software as a business, contact the author at the address given in the README. That is not legal advice and this article does not give any, but it tells you that the maintainer treats commercial use as a case worth raising directly, and the project separates the open source release from that conversation. The repository also carries a PayPal support badge. On the maintenance side, the repository is not archived and the last push was on 2026-10-09, with tagged releases at 7.0.0 on 2026-01-13, 7.1.0 on 2026-05-12 and 7.1.1 on 2026-07-07.

## Conclusion

Authme suits anyone who wants one encrypted, offline place to keep TOTP codes across several desktops and does not mind owning the export file. Do not adopt it if you need shared or managed credentials, or if you cannot store a backup somewhere safe. Before migrating, verify your OS build from the downloads page, keep the .authme export until a few fresh codes have been confirmed on the new device, and read the password and recovery behaviour in the app itself, since the README does not spell either one out.

## FAQ

### Can I import my existing codes from Google Authenticator into Authme?

Yes. The README lists Google Authenticator as a supported type and states that you can export all of your existing codes and import them into Authme. It also lists import support for backups created in 2FAS and for vaults exported from Aegis.

### Does Authme need an internet connection to show codes?

The README states that Authme is completely offline and that internet is only required for updates. That covers code generation and display, since the only network need it names is the update check.

### How are my 2FA codes protected inside Authme?

The README states that codes are secured by AES 256bit encryption with your own password. It does not describe how the password is derived into a key, nor how recovery works if the password is lost.

### Which platforms does Authme run on?

The feature list states you can use Authme on every system you own, with availability on Windows, Linux, macOS and web. The downloads section also lists the Microsoft Store, Snapcraft, winget and Scoop as distribution channels.

## Sources

- [Levminer/authme on GitHub](https://github.com/Levminer/authme)
- [License: GPL-3.0](https://github.com/Levminer/authme/blob/dev/LICENSE)
- [Project website](https://authme.levminer.com)
- [README](https://github.com/Levminer/authme/blob/dev/README.md)
- [Releases](https://github.com/Levminer/authme/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/levminer-authme