SelfHostAuth
SelfHostAuth is a free, open-source authenticator and synchronization server that you host yourself.
What SelfHostAuth is
SelfHostAuth is a free, open-source authenticator and synchronization server that you host yourself. It creates time-based and event-based one-time passwords using TOTP and HOTP, supporting RFC 4226 and RFC 6238, SHA-1, SHA-256, and SHA-512, six to eight digits, and configurable periods. Accounts can be added by scanning or pasting a QR code, an otpauth:// address, or a raw base32 secret. Revision-based push and pull synchronization keeps vaults aligned across devices, with deletions propagated through tombstones and last-write-wins handling. Clients cache the vault locally and calculate TOTP codes without a server connection. Vault items are encrypted at rest with AES-256-GCM; passwords use scrypt hashing and session tokens use SHA-256. Optional account TOTP authentication is available. Clients include web, Windows, macOS, Linux, iOS, Android, and Chrome, Edge, and Firefox extensions. The Node.js 22+ and SQLite server can run through Docker Compose, systemd, or directly on a home server, NAS, Raspberry Pi, or VPS. There is no hosted version.
Good
- Free MIT-licensed open-source project
- TOTP and HOTP with configurable code settings
- Multi-device sync with deletion propagation
- Offline code generation from a local vault
- Clients span web, desktop, mobile, and extensions
Watch out
- Self-hosted only; no hosted version
- Push approvals are not supported
- Requires Node.js 22+ and SQLite server setup
- Security report lists high and medium findings
Who it suits
It suits homelabbers, privacy advocates, teams needing a self-hosted OTP server, and people seeking alternatives to Google Authenticator or Authy. It fits users who can manage deployment on their own infrastructure.
Verdict
SelfHostAuth provides broad authenticator coverage and synchronized, offline-capable vaults without a hosted subscription. It is most suitable when you want to operate the server and accept the listed security and maintenance responsibilities.
Plans and prices
From SelfHostAuth's own pricing page, checked 9 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| SelfHostAuth | Free | Open source · self-hosted only · no hosted version |
The facts
Each one read from SelfHostAuth's own pages, with the date it was checked.
What it does
- Audience
- The README identifies homelabbers, privacy advocates, teams needing a self-hosted OTP server, and people seeking alternatives to Google Authenticator or Authy as its intended users.checked 9 Oct 2026
- Availability limit
- The project says there is no hosted version and it is self-hosted only by design.checked 9 Oct 2026
- Clients
- The project lists a web vault, Windows/macOS/Linux Electron desktop apps, iOS and Android apps, and Chrome/Edge/Firefox browser extensions.checked 9 Oct 2026
- Code standards
- It supports RFC 4226 and RFC 6238, SHA-1, SHA-256, and SHA-512, 6–8 digits, and configurable periods.checked 9 Oct 2026
- Code type
- totp and hotpchecked 21 Sep 2026
- Deployment
- The server uses Node.js 22+ and SQLite and can run with Docker Compose, systemd, or bare metal on a home server, NAS, Raspberry Pi, or VPS.checked 9 Oct 2026
- Imports
- Users can add accounts by scanning or pasting a QR code, an otpauth:// URI, or a raw base32 secret.checked 9 Oct 2026
- Integrations
- It accepts otpauth:// imports and provides a typed TypeScript API client for its sync server.checked 9 Oct 2026
- License
- The repository is licensed under MIT.checked 9 Oct 2026
- Offline use
- Clients cache the vault locally and compute TOTP codes without connecting to the server.checked 9 Oct 2026
- Purpose
- SelfHostAuth is an open-source, self-hosted TOTP/HOTP authenticator and sync server.checked 9 Oct 2026
- Security
- The server encrypts vault items at rest with AES-256-GCM, hashes passwords with scrypt and session tokens with SHA-256, and supports optional account TOTP authentication.checked 9 Oct 2026
- Security disclosures
- The vulnerability report last checked on 2026-09-28 lists one high and one medium finding, including a pnpm audit summary of 24 vulnerabilities.checked 9 Oct 2026
- Support policy
- The security policy says maintainers aim to acknowledge vulnerability reports within three business days and ship a fix or mitigation within 30 days for high-severity issues.checked 9 Oct 2026
- Sync
- Revision-based push/pull sync uses last-write-wins and tombstones so deleting a code on one device deletes it across devices.checked 9 Oct 2026
- Transport
- The project says to use TLS through a reverse proxy; HTTPS is required for mobile apps and browser extensions when connecting outside localhost.checked 9 Oct 2026
Money
- Free plan
- Yeschecked 21 Sep 2026
Where it runs
- Multi-device sync
- Yeschecked 21 Sep 2026
- Push approvals
- Nochecked 21 Sep 2026
- Supported platforms
- web,windows,macos,linux,ios,android,chrome_extensionchecked 21 Sep 2026
Alternatives to SelfHostAuth
- 1
Bitwarden
Free planOpen sourceAndroidiOSWebAPI9.3From $1.65 a month - 2
Duo Mobile
Free planAndroidiOS8.5From $3 a month - 3
SAASPASS Authenticator
Free planAndroidiOSWebExtension8.4From $1 a year - 4
LastPass
Free planAndroidiOSWebExtension8.4Free plan - 5
Yubico Authenticator
Free planAndroidiOSLinuxmacOS8.1Free plan - 6
HYPR Authenticate
AndroidiOSWebAPI8.1From $3 a month