Best / OTP authenticators
Best open-source OTP authenticators
The best self-hosted OTP split in the c17.io catalog is 2FAuth for an AGPL-3.0 web TOTP vault (the published Authy / Google Authenticator path), Ente Auth when you want that AGPL-3.0 E2EE app from the ente/ente monorepo — /compare/twofauth-vs-ente, Vaultwarden when TOTP lives next to the Bitwarden-compatible password vault — /best/password-manager, and Keycloak when the job is an Apache-2.0 IdP OTP rather than a vault you open — /best/auth-identity. This is not Authy's every SMS fallback or Duo's every SSO SKU. Passwords stay on /replace/1password.
Open the stackStart on Railway
Ranked picks
1
2FAuthAGPL-3.0 web TOTP vault (4,182 stars in the catalog) — the c17 Authy path. /compare/twofauth-vs-ente.
When to pick it: Codes on a box you run.
4,182 stars in the catalog
2
EnteAGPL-3.0 E2EE authenticator in the ente/ente monorepo (29,448 stars in the catalog). /compare/twofauth-vs-ente.
When to pick it: A mobile app if 2FAuth is not the shape.
29,448 stars in the catalog
3
VaultwardenAGPL Bitwarden-compatible vault already on /best/password-manager. Not a lone TOTP box.
When to pick it: TOTP next to passwords.
69,182 stars in the catalog
4
KeycloakApache-2.0 IdP OTP already on /best/auth-identity. Not an authenticator app.
When to pick it: Workforce 2FA if Authy was the IdP, not the vault.
37,403 stars in the catalog
How they compare
| Tool | License | Self-host | Best for |
|---|---|---|---|
| 2FAuth | GNU Affero General Public License v3.0 | Easy | Codes on a box you run. |
| Ente | GNU Affero General Public License v3.0 | Easy | A mobile app if 2FAuth is not the shape. |
| Vaultwarden | GNU Affero General Public License v3.0 | Easy | TOTP next to passwords. |
| Keycloak | Apache License 2.0 | Medium | Workforce 2FA if Authy was the IdP, not the vault. |
Related pages
- 2FAuth / Ente Auth stack
- Vaultwarden stack
- Keycloak / Authentik stack
- Replace Authy
- Replace Google Authenticator
- Replace LastPass
- Replace 1Password
- Replace Bitwarden Cloud
- Replace Dashlane
- Replace Keeper
- Replace Okta
- 2FAuth vs Ente Auth
- All best open-source pages
- All compare pages
- All replace pages
- All stacks
- Tools catalog
FAQ
- 2FAuth or Ente Auth?
- 2FAuth if you want the published web vault. Ente Auth if you want that E2EE app — /compare/twofauth-vs-ente.
- Is this 1Password?
- Passwords stay on /replace/1password. This page is the authenticator codes.
- Is this Duo?
- Duo is a hosted MFA suite. The tools listed here do not cover every Duo SSO SKU.
- Are these free?
- 2FAuth and Ente Auth are AGPL-3.0. Vaultwarden is AGPL-3.0. Keycloak is Apache-2.0. You pay hosting. Template users never pay c17.
- How do I deploy it?
- Open /stacks/twofauth-otp. Persist the database. Add one TOTP you actually use.
Stack of the Week
Get one stack a week that replaces a SaaS bill.