Hero Authenticator

Hero Systems

About this app

Hero Authenticator makes the six-digit codes your accounts ask for when you log in - and makes sure the phone they live on isn't a single point of failure.

Codes are generated on your device with the standard TOTP algorithm, so they work with any service that supports authenticator-app two-factor sign-in, and they work with no connection at all.

ADD ACCOUNTS HOWEVER SUITS YOU
- Scan the QR code a service shows you
- Import a QR from a screenshot already in your photo library
- Paste or type a setup key
- Fill everything in by hand - issuer, label, digits, period, algorithm
- Move in from another Authenticator app using its export QR

A LOCK THAT STAYS SHUT
Set a 4- or 6-digit PIN and add Face ID or Touch ID. Choose when the app re-locks: the moment you leave it, after 30 seconds, a minute, five minutes, or not at all. Wrong PINs trigger a lockout that grows each time and survives restarting the app. Your PIN is stored as a salted PBKDF2 hash, never as the PIN.

A WAY BACK
Your install gets a 24-word recovery phrase. Write it down and keep it offline. Turn on cloud backup and your account secrets are encrypted on your device before they are sent, keyed to that phrase - then type the phrase on a new phone and your accounts come back.

Cloud backup stays off until you switch it on. Leave it off and nothing about your accounts ever leaves the phone.

DAY TO DAY
- A live countdown on every code, so you know whether to wait for the next one
- Search across issuers and account names
- Tap a code to copy it
- Edit labels and delete what you no longer use
- Export selected accounts as a QR or through the share sheet
- Light and dark themes
- 17 languages

WHAT IT DOESN'T DO
No ads. No analytics and no crash-reporting SDKs of any kind. No account, no email address, no phone number, nothing to sign up for.

One thing worth saying plainly: your recovery phrase is the only way back into a backup. If you lose it, nobody - including us - can restore your accounts for you. That is the trade a phrase-based backup makes, and it is why the app asks you to write it down.

What’s new

First release.

Hero Authenticator generates the one-time codes your accounts ask for at
sign-in. Codes are created on your device and stay there; there is no account
to make and nothing to sign in to.

Add a code by scanning a QR code, importing an image, or typing the key in
by hand. If you turn on backup, your codes can be restored on a new device
with a 24-word recovery phrase that only you hold.