VaultOTP user docs

User workflow

Open the app, create a user account, then add or import 2FA entries.

The main page is for finding, showing, copying, pinning, sorting, and organizing your own codes.

Settings contains account safety, display preferences, import/export, PAT, PWA/offline, batch organization, and activity logs.

Import and export

Import supports otpauth text, Google Authenticator migration URIs, QR images, Aegis, 2FAS, 2FAuth, Bitwarden readable JSON, LastPass CSV, Proton Pass readable exports, Raivo, and andOTP.

Imports are previewed first. Duplicate or invalid entries are marked before they are saved.

Encrypted backup export keeps encrypted entry data. Plain otpauth export requires an explicit warning confirmation.

PAT API

Create a Personal Access Token in Settings > PAT settings.

PAT calls only operate on the current user's entries and codes.

Code responses include the current code, period, remaining time, digits, type, and server time. Plain secrets are not returned.

PWA and offline use

The web app can be installed as a PWA from the browser.

After you add or import TOTP entries while online, cached TOTP entries can generate codes locally when offline.

Offline cache is device-local and encrypted by the browser. Server data remains the source of truth when online.

Privacy notes

Passwords are stored as salted PBKDF2 hashes on the server.

Saved secrets are stored encrypted by the server key pair.

Activity logs record operation metadata, not plain secrets, PAT values, or OTP codes.

PAT API

Examples

curl -H "Authorization: Bearer <PAT>" "https://www.2fakey.icu/api/entries"

curl -H "Authorization: Bearer <PAT>" "https://www.2fakey.icu/api/entries/{entryId}/code"