EVERYTHING XIAOMI
Get listed

OTPClient

Place
#99 of 111
Score
6.1
OTPClient's website

The facts below are what the maker publishes about OTPClient, checked and dated. Our editors have not written about it yet.

Plans and prices

From OTPClient's own pricing page, checked 12 Oct 2026.

All about pricing
PlanPriceWhat it gives you
OTPClientFreeGPLv3; available as Flatpak, in distro repositories, and from source

The facts

Each one read from OTPClient's own pages, with the date it was checked.

What it does

Availability and license
The project says OTPClient is available as a Flatpak and in several distribution repositories, and that it is released under GPLv3.checked 12 Oct 2026
Backup
Token backups are byte-for-byte copies of the encrypted database written with 0600 permissions, and restoring opens the backup as an additional database without overwriting the active one.checked 12 Oct 2026
Code type
totp and hotpchecked 22 Sep 2026
Command line
The CLI can list or show tokens, select databases, import or export data, and produce table, JSON, or CSV output for supported commands.checked 12 Oct 2026
Desktop integrations
Its desktop search provider integrates with GNOME Shell Activities Search and KDE Plasma 6 KRunner, and the CLI includes Bash, zsh, and fish completions.checked 12 Oct 2026
Encrypted backup
Yeschecked 22 Sep 2026
Import and export
It supports migration with Aegis, AuthenticatorPro, 2FAS, FreeOTPPlus, and Google migration QR codes (import only).checked 12 Oct 2026
Local encryption
The local database uses AES-256-GCM encryption with a password-derived Argon2id key; the documented defaults are 4 iterations, 128 MiB memory, and parallelism 4.checked 12 Oct 2026
Memory protection
The project says decrypted token data and secrets are held in locked libgcrypt secure memory and wiped from memory when the database is locked.checked 12 Oct 2026
OTP support
It supports TOTP, HOTP, Steam Guard codes, SHA1/SHA256/SHA512, and manual or otpauth URI token entry with 4–10 digits and 1–120 second periods.checked 12 Oct 2026
Purpose
OTPClient is a GTK4/libadwaita application for managing TOTP and HOTP two-factor authentication tokens, with CLI and desktop-search integration.checked 12 Oct 2026
Security limits
The security policy says a same-UID attacker with ptrace or /proc/PID/mem access can read secrets while the database is unlocked, and cold-boot or DMA attacks can recover secrets from RAM on an unlocked machine.checked 12 Oct 2026
Security support
The security policy lists version 5.1.x as Active, 5.0.x as Maintenance, and versions below 5.0 as End of life.checked 12 Oct 2026
Token entry
Tokens can be added by scanning a QR code from an image, webcam, or clipboard, or by entering the secret manually.checked 12 Oct 2026
Vulnerability reporting
The security policy asks researchers to report vulnerabilities by email rather than opening a public issue, and says acknowledgment is within 24 hours and a fix will be developed and released within 7 days.checked 12 Oct 2026

The company

Maker
The GitHub repository is owned by Paolo Stivanin, whose profile lists Italy and SUSE.checked 12 Oct 2026

Where it runs

Supported platforms
Linux desktopchecked 22 Sep 2026

Alternatives to OTPClient

All alternatives
  1. 1Bitwarden logo

    Bitwarden

    Free planOpen sourceAndroidiOSWebAPI
    9.3From $1.65 a month
    Visit
  2. 2Duo Mobile logo

    Duo Mobile

    Free planAndroidiOS
    8.5From $3 a month
    Visit
  3. 3

    SAASPASS Authenticator

    Free planAndroidiOSWebExtension
    8.4From $1 a year
    Visit
  4. 4LastPass logo

    LastPass

    Free planAndroidiOSWebExtension
    8.4Free plan
    Visit
  5. 5

    Yubico Authenticator

    Free planAndroidiOSLinuxmacOS
    8.1Free plan
    Visit
  6. 6

    HYPR Authenticate

    AndroidiOSWebAPI
    8.1From $3 a month
    Visit