Hostspica Authenticator

Hostspica

About this app

HostSpica Authenticator generates your two-factor authentication codes entirely on your device — no cloud account, no sign-up, no data collection, and no network connection of any kind. It's built for people who want their 2FA secrets to stay exactly where they belong: with them.

WHY HOSTSPICA AUTHENTICATOR

Most authenticator apps ask for more than they need or quietly nudge you toward a cloud account. This one doesn't. There's nothing to sign up for, nothing syncs anywhere, and the app has no permission to access the internet at all — it is structurally incapable of sending your data anywhere, not just promising not to.

KEY FEATURES

• Both TOTP and HOTP support — time-based codes (RFC 6238) for modern services like GitHub, Google, Microsoft and AWS, plus counter-based codes (RFC 4226) for older hardware-token vendors that most authenticator apps have dropped support for.

• Bank-grade encryption — every secret is encrypted at rest with AES-256-GCM using a key generated inside your device's Android Keystore, hardware-backed (StrongBox) where supported. The key never leaves secure hardware.

• Biometric lock — fingerprint or device PIN/pattern is required to open the app, reveal a code, export a backup, or delete an account.

• Zero network permissions — no analytics, no crash reporting, no ad SDKs. The app cannot make a network call even if it wanted to.

• Screen protection — screenshots, screen recording, and the recent-apps preview are all blocked from ever showing a live code.

• Import from Google Authenticator — scan its "Export accounts" QR code directly, including exports that span multiple pages, and choose exactly which accounts to bring over.

• Export anytime — move any account to another app with a standard QR code, or back up your whole library to a single password-encrypted file you save wherever you choose.

• Clean, fast interface — search, favorites, custom groups, and a swipe-to-delete with a confirmation step so nothing is removed by accident.

• Dark mode, done properly — matches your system theme or set it manually.

YOUR DATA STAYS YOURS

Account names and secret keys never leave your device unless you deliberately export a backup yourself. There is no server, so there is nothing for anyone — including us — to breach.

A backup file you create is encrypted with a password only you know. If you lose it, we have no way to recover it, because we never had access to it in the first place.

PERMISSIONS, EXPLAINED

• Camera — only used to scan a QR code when adding an account. Never recorded or stored.

• Biometric — used only to lock the app; handled entirely by Android, never seen by the app.

• Storage — only when you explicitly choose to export or import a backup file via the system file picker.

No internet permission is requested, because none is needed.

Built by HostSpica, an independent software studio. This app is part of HostSpica Labs, our line of free, independently built tools.