# 2FAuth / Ente Auth

Authenticator codes you host. 2FAuth is AGPL-3.0; Ente Auth is AGPL-3.0 — Authy and Google Authenticator without a vendor vault.

**Replaces:** Authy / Google Authenticator

**Tier:** Easy

## Problem

Authy is Twilio's hosted 2FA vault (backups live there). Google Authenticator is a local app with optional Google-account sync. You wanted TOTP/HOTP codes on a box you run, or an E2EE app whose code you can read. 2FAuth is AGPL-3.0 (self-hosted web vault). Ente Auth is AGPL-3.0 in the ente/ente monorepo — an authenticator app, not a small HTTP box. This is not Authy's multi-device SMS fallback or every hardware-key ceremony. Passwords stay on /replace/1password.

## Stack

- [2FAuth](https://docs.2fauth.app/) — AGPL-3.0 self-hosted 2FA account manager and TOTP generator
- [Ente Auth](https://ente.com) — AGPL-3.0 E2EE authenticator app (ente/ente monorepo)

## Estimated SaaS cost saved

| You stop paying | Typical / year | Self-host instead |
|---|---:|---|
| Authy / Google Authenticator sync (household) | $1,200 | 2FAuth or Ente Auth |

**About $1,200 / year** on a small team, before you count lock-in.

## Deploy on Railway

Placeholder: 2FAuth + a database and a volume. Bind HTTP to 0.0.0.0:$PORT. Ente Auth is a mobile/desktop app; self-hosting the full Ente stack is a different, heavier box. No one-click template in this repo yet — Start on Railway. Password vaults stay on /stacks/vaultwarden-passwords.

[Start on Railway](https://c17.io/go/railway/twofauth-otp?from=%2Fstacks%2Ftwofauth-otp.md)

[Vaultwarden if this is passwords, not TOTP](https://c17.io/stacks/vaultwarden-passwords)

## AGENT_PROMPT

```
Replace Authy or Google Authenticator with 2FAuth (preferred self-host) or Ente Auth (app).

- 2FAuth: official image, persist the database, bind HTTP, create one TOTP you actually use. Export/import is a cutover — do not invent an Authy dump if Twilio does not give you one.
- Ente Auth if you want an E2EE mobile app from the ente/ente AGPL monorepo rather than a web vault.
- Write AGENT_PROMPT.md. Passwords stay on /stacks/vaultwarden-passwords.
```

## FAQ

### 2FAuth or Ente Auth?

2FAuth if you want a self-hosted web vault. Ente Auth if you want an E2EE authenticator app. They are not the same deploy.

### Will Authy backups import?

Treat it as a cutover. Re-scan the issuers you still use. Do not promise an official Authy export.

Source: https://c17.io/stacks/twofauth-otp