2FAuth if you want a self-hosted web vault. Ente Auth if you want an E2EE authenticator app. They are not the same deploy.

Will Authy backups import?

Treat it as a cutover. Re-scan the issuers you still use. Do not promise an official Authy export.

Stacks / Auth

Easy

2FAuth / Ente Auth

Authenticator codes you host. 2FAuth is AGPL-3.0; Ente Auth is AGPL-3.0 — Authy and Google Authenticator without a vendor vault.

The problem

Authy is Twilio's hosted 2FA vault (backups live there). Google Authenticator is a local app with optional Google-account sync. You wanted TOTP/HOTP codes on a box you run, or an E2EE app whose code you can read. 2FAuth is AGPL-3.0 (self-hosted web vault). Ente Auth is AGPL-3.0 in the ente/ente monorepo — an authenticator app, not a small HTTP box. This is not Authy's multi-device SMS fallback or every hardware-key ceremony. Passwords stay on /replace/1password.

Replaces

Authy / Google Authenticator

Replace Authy Replace Google Authenticator

Estimated SaaS saved

$1,200

per year, small team, before lock-in

Start on Railway

Vaultwarden if this is passwords, not TOTP

Sponsor this stack Tip jar

Placeholder: 2FAuth + a database and a volume. Bind HTTP to 0.0.0.0:$PORT. Ente Auth is a mobile/desktop app; self-hosting the full Ente stack is a different, heavier box. No one-click template in this repo yet — Start on Railway. Password vaults stay on /stacks/vaultwarden-passwords.

The stack

2FAuth
AGPL-3.0 self-hosted 2FA account manager and TOTP generator
Catalog entry →
Ente Auth
AGPL-3.0 E2EE authenticator app (ente/ente monorepo)
Catalog entry →

Cost table

You stop paying	Typical / year	Self-host instead
Authy / Google Authenticator sync (household)	$1,200	2FAuth or Ente Auth

Agent setup prompt

Replace Authy or Google Authenticator with 2FAuth (preferred self-host) or Ente Auth (app).

- 2FAuth: official image, persist the database, bind HTTP, create one TOTP you actually use. Export/import is a cutover — do not invent an Authy dump if Twilio does not give you one.
- Ente Auth if you want an E2EE mobile app from the ente/ente AGPL monorepo rather than a web vault.
- Write AGENT_PROMPT.md. Passwords stay on /stacks/vaultwarden-passwords.

Also as markdown: /stacks/twofauth-otp.md

FAQ

2FAuth or Ente Auth?: 2FAuth if you want a self-hosted web vault. Ente Auth if you want an E2EE authenticator app. They are not the same deploy.
Will Authy backups import?: Treat it as a cutover. Re-scan the issuers you still use. Do not promise an official Authy export.