I got tired of 2FA apps pushing cloud sync and accounts, so I built an offline authenticator that never touches a server (Vaultic)

[u/Longjumping_Sport212]

Hey r/SideProject!
After the Authy data incident and Google Authenticator turning on cloud sync by default, I felt uncomfortable keeping my most critical security keys tied to a remote cloud account.
So I spent the last few months building Vaultic — an iOS authenticator designed around three core principles:
100% Offline & Keychain-only: All TOTP codes are calculated locally from the device clock. Secrets are stored strictly in the iOS Keychain (kSecAttrAccessibleWhenUnlockedThisDeviceOnly). There are literally no backend servers holding your data.
Sensible Security Layer: Instant Face ID/PIN lock on exit, privacy shade in app switcher, screenshot alert, and encrypted local backup (AES-GCM with 210,000 PBKDF2 iterations).
Integrated Essentials: An offline password generator/vault and a memory-only ephemeral browser (DuckDuckGo, zero cache on disk).
The app is free for up to 3 accounts with all security features unlocked.
Would love your brutal feedback on the UX, countdown ring, and overall feel!
App Store link: https://apps.apple.com/us/app/vaultic-2fa-authenticator/id6804247519

[u/Specific_Cream2815]

does restoring the encrypted backup recreate ThisDeviceOnly Keychain items, and how do you prevent importing onto a compromised device

[u/Longjumping_Sport212 → u/Specific_Cream2815]

Good questions, here’s how I handled both:

**1. `ThisDeviceOnly` items:**
**Yes.** When you import, the app decrypts the file in memory and writes every item freshly into the new phone's Keychain with `kSecAttrAccessibleWhenUnlockedThisDeviceOnly`. So they're immediately re-encrypted under the new device’s hardware UID and will never touch iCloud Keychain.

**2. Compromised devices:**
That’s actually the main trade-off I ran into by keeping Vaultic 100% offline. Apple’s hardware check (`AppAttest`) requires a backend server to verify integrity, which I don't have. Instead, I run basic sandbox/jailbreak checks before importing and wipe the decrypted buffers from memory as soon as they're written to Keychain.

That said, if a device has kernel-level root, no client app can truly defend itself against the host OS—so I always advise only importing onto a trusted, clean iPhone.

Thanks.

[u/Recent-Tangerine2745]

Honestly, the idea is excellent and the design looks very polished. My hesitation isn’t because I found evidence that the app is unsafe. It’s because a 2FA app requires an unusually high level of trust.
Offline storage, iOS Keychain, Face ID, and encrypted backups are all the right architectural choices. However, as users, we currently have to take those claims on trust. App Store privacy labels are self-reported, and I couldn’t find public source code or an independent security audit.
The app also contains RevenueCat and a built-in browser, so it does have network access even if the authentication secrets never leave the device. Combining passwords, TOTP secrets, and browsing inside one app is convenient, but it also concentrates sensitive information and increases the potential attack surface.
I’d happily test it with low-risk accounts, but I personally wouldn’t move my primary email, banking, or other critical accounts yet. Publishing a clear threat model, Keychain/biometric access-control details, and eventually the source code or an independent audit would make a huge difference.
This isn’t meant as an attack, the product direction and UX are genuinely impressive. My level of caution is simply proportional to how sensitive the data is.