RotarySafe TOTP Authenticator
In-app purchases
Everyone
info
10+
Downloads
About this app
Turn your watch bezel or crown to unlock your 2FA codes. That's it.
RotarySafe is a two-factor authentication manager for Android and Wear OS that stores every secret on your devices and unlocks TOTP codes with a physical rotary combination — no server, no cloud sync, no copy of your secrets sitting somewhere you didn't choose.
HOW IT WORKS
Set a rotary combination on your Wear OS watch crown — like a miniature combination safe on your wrist. You can switch between bezel or crown view to customize as needed. When you need a 2FA code, enter your combination by turning the bezel or crown. RotarySafe verifies it and displays the live TOTP code directly on your watch face. Nothing leaves your devices.
SECURITY ARCHITECTURE
No internet access. RotarySafe holds no INTERNET permission and makes zero network requests. A server breach cannot expose your secrets, because there is no server. Restoring or transferring the app will bring an empty data base, export and import functions with reminders are available for it.
All TOTP secrets are stored in Android EncryptedSharedPreferences, backed by the Android Keystore and hardware-bound where your device supports it.
Your rotary combination is stored only as a PBKDF2-HMAC-SHA256 hash (100,000 iterations, 16-byte random salt per setup). The raw combination is never stored or logged.
Every phone-to-watch message is encrypted with AES-256-GCM using a fresh random IV. The session key is established via ephemeral ECDH (NIST P-256) on every pairing — no long-term shared secret to steal.
After three failed combination attempts, the app hard-locks and requires biometric authentication on the phone to clear — even across restarts and device reboots.
Encrypted backups use Argon2id for key derivation.
Keep your backup in a secure location, such as your private cloud storage. You'll need it to restore your accounts on a new device.
No server-side component means no supply-chain attack vector against your secrets. The physical combination adds an authentication factor independent of your biometrics and your phone's screen lock.
Each pairing ceremony generates a fresh session key via ephemeral ECDH — there is no long-term root key that bridges pairings. Compromising a stored session key gives access to that pairing's traffic, but a future re-pair produces fully independent key material.
Revocation is authenticated: forcing the watch back to an unpaired state requires proof of the current session key.
WEAR OS REQUIRED
RotarySafe requires a paired Wear OS watch. The watch provides the rotary combination interface and displays TOTP codes directly on the wrist.
COMPATIBILITY
Supports all standard TOTP accounts (RFC 6238): Google, GitHub, AWS, Microsoft, and any service that provides a standard authenticator QR code. Import by scanning the issuer QR code with the phone app.
FREE TIER: 2 TOTP accounts with full functionality
PREMIUM: Unlock unlimited accounts for a one-time payment
RotarySafe is completely free to use with up to 2 accounts.
No ads, no tracking, no cloud sync. All encryption happens
locally on your device and watch.
Premium is optional and provides unlimited account storage
if you need more than 2 accounts.
RotarySafe is a two-factor authentication manager for Android and Wear OS that stores every secret on your devices and unlocks TOTP codes with a physical rotary combination — no server, no cloud sync, no copy of your secrets sitting somewhere you didn't choose.
HOW IT WORKS
Set a rotary combination on your Wear OS watch crown — like a miniature combination safe on your wrist. You can switch between bezel or crown view to customize as needed. When you need a 2FA code, enter your combination by turning the bezel or crown. RotarySafe verifies it and displays the live TOTP code directly on your watch face. Nothing leaves your devices.
SECURITY ARCHITECTURE
No internet access. RotarySafe holds no INTERNET permission and makes zero network requests. A server breach cannot expose your secrets, because there is no server. Restoring or transferring the app will bring an empty data base, export and import functions with reminders are available for it.
All TOTP secrets are stored in Android EncryptedSharedPreferences, backed by the Android Keystore and hardware-bound where your device supports it.
Your rotary combination is stored only as a PBKDF2-HMAC-SHA256 hash (100,000 iterations, 16-byte random salt per setup). The raw combination is never stored or logged.
Every phone-to-watch message is encrypted with AES-256-GCM using a fresh random IV. The session key is established via ephemeral ECDH (NIST P-256) on every pairing — no long-term shared secret to steal.
After three failed combination attempts, the app hard-locks and requires biometric authentication on the phone to clear — even across restarts and device reboots.
Encrypted backups use Argon2id for key derivation.
Keep your backup in a secure location, such as your private cloud storage. You'll need it to restore your accounts on a new device.
No server-side component means no supply-chain attack vector against your secrets. The physical combination adds an authentication factor independent of your biometrics and your phone's screen lock.
Each pairing ceremony generates a fresh session key via ephemeral ECDH — there is no long-term root key that bridges pairings. Compromising a stored session key gives access to that pairing's traffic, but a future re-pair produces fully independent key material.
Revocation is authenticated: forcing the watch back to an unpaired state requires proof of the current session key.
WEAR OS REQUIRED
RotarySafe requires a paired Wear OS watch. The watch provides the rotary combination interface and displays TOTP codes directly on the wrist.
COMPATIBILITY
Supports all standard TOTP accounts (RFC 6238): Google, GitHub, AWS, Microsoft, and any service that provides a standard authenticator QR code. Import by scanning the issuer QR code with the phone app.
FREE TIER: 2 TOTP accounts with full functionality
PREMIUM: Unlock unlimited accounts for a one-time payment
RotarySafe is completely free to use with up to 2 accounts.
No ads, no tracking, no cloud sync. All encryption happens
locally on your device and watch.
Premium is optional and provides unlimited account storage
if you need more than 2 accounts.
Offline Wear OS TOTP authenticator
Updated on
Safety starts with understanding how developers collect and share your data. Data privacy and security practices may vary based on your use, region, and age. The developer provided this information and may update it over time.
- No data shared with third partiesLearn more about how developers declare sharing
- No data collectedLearn more about how developers declare collection
What’s new
keep session open
App support
About the developer
Andres Auslender
WearableDevDesign@gmail.com
Chemin de la Faucille 29
1290 Chavannes-des-Bois
Switzerland
