---
Type: desktop-application
ID: com.github.paolostivanin.OTPClient.desktop
Package: otpclient
ProjectLicense: GPL-3.0+
Name:
C: OTPClient
Summary:
C: Application for managing TOTP/HOTP tokens with built-in encryption
Description:
C: >-
<p>OTPClient is a secure and easy-to-use desktop client for TOTP and HOTP one-time passwords, built with GTK4 and libadwaita. Features:</p>
<ul>
<li>multiple databases with sidebar management and cross-database search</li>
<li>token grouping with quick filtering</li>
<li>desktop search provider for GNOME Shell and KDE KRunner (opt-in trigger keyword)</li>
<li>command-line companion (otpclient-cli) with scriptable table/JSON/CSV output</li>
<li>support for TOTP, HOTP, and Steam codes</li>
<li>configurable digits (4 to 10), period (1 to 120 seconds), and algorithm (SHA1, SHA256, SHA512)</li>
<li>import and export of encrypted/plain Aegis backups</li>
<li>import and export of encrypted/plain Authenticator Pro and 2FAS backups</li>
<li>import and export of plain FreeOTP+ backups (key URI format)</li>
<li>import of Google Authenticator migration QR codes (file, screen, webcam, clipboard)</li>
<li>integration with the OS secret service provider via libsecret (opt-in)</li>
<li>local database encrypted with AES-256-GCM and Argon2id key derivation; plaintext lives only in libgcrypt secure memory while
unlocked</li>
</ul>
Developer:
name:
C: Paolo Stivanin
Categories:
- System
- Security
Keywords:
C:
- otp
- totp
- hotp
- "2fa"
- "2factor"
- "2fa-client"
- "2step"
- twostep
Url:
homepage: https://github.com/paolostivanin/OTPClient
bugtracker: https://github.com/paolostivanin/OTPClient/issues
Icon:
cached:
- name: otpclient_com.github.paolostivanin.OTPClient.png
width: 48
height: 48
- name: otpclient_com.github.paolostivanin.OTPClient.png
width: 64
height: 64
- name: otpclient_com.github.paolostivanin.OTPClient.png
width: 128
height: 128
remote:
- url: com/github/paolostivanin.OTPClient.desktop/132a004f21a9fffea27a4da6857b5bea/icons/128x128/otpclient_com.github.paolostivanin.OTPClient.png
width: 128
height: 128
stock: com.github.paolostivanin.OTPClient
Launchable:
desktop-id:
- com.github.paolostivanin.OTPClient.desktop
Provides:
binaries:
- otpclient
Screenshots:
- default: true
caption:
C: Empty main window
thumbnails:
- url: com/github/paolostivanin.OTPClient.desktop/132a004f21a9fffea27a4da6857b5bea/screenshots/image-1_224x263@1.png
width: 224
height: 263
source-image:
url: com/github/paolostivanin.OTPClient.desktop/132a004f21a9fffea27a4da6857b5bea/screenshots/image-1_orig.png
width: 501
height: 590
- caption:
C: Add menu
thumbnails:
- url: com/github/paolostivanin.OTPClient.desktop/132a004f21a9fffea27a4da6857b5bea/screenshots/image-2_224x263@1.png
width: 224
height: 263
source-image:
url: com/github/paolostivanin.OTPClient.desktop/132a004f21a9fffea27a4da6857b5bea/screenshots/image-2_orig.png
width: 501
height: 590
- caption:
C: General menu
thumbnails:
- url: com/github/paolostivanin.OTPClient.desktop/132a004f21a9fffea27a4da6857b5bea/screenshots/image-3_224x263@1.png
width: 224
height: 263
source-image:
url: com/github/paolostivanin.OTPClient.desktop/132a004f21a9fffea27a4da6857b5bea/screenshots/image-3_orig.png
width: 501
height: 590
- caption:
C: Settings menu
thumbnails:
- url: com/github/paolostivanin.OTPClient.desktop/132a004f21a9fffea27a4da6857b5bea/screenshots/image-4_224x257@1.png
width: 224
height: 257
source-image:
url: com/github/paolostivanin.OTPClient.desktop/132a004f21a9fffea27a4da6857b5bea/screenshots/image-4_orig.png
width: 352
height: 405
Releases:
- version: "5.1.4"
type: stable
unix-timestamp: 1783641600
description:
C: >-
<p>Bug-fix release. Following the anonymous-token fix in 5.1.3, a database containing a token with an out-of-range digit count still
refused to open, again locking users out of every other token. The load-time validator was stricter than the OTP engine and the
app's own UI; the accepted ranges now match the engine (digits 4 to 10, period 1 to 120 seconds). Any token the engine still cannot
use is set aside so the rest of the database opens, and is preserved for repair rather than dropped.</p>
<ul>
<li>FIX: a database containing a token with an out-of-range digit count (or period) refused to open, locking users out of
all their tokens. Accepted ranges now match the OTP engine (digits 4 to 10, period 1 to 120), and any token that still cannot be
loaded is kept aside and preserved instead of bricking the whole database (#464, follow-up to #458/#462)</li>
<li>FIX: right-click context menus on tokens and databases were clipped to the scrolled area and needed scrolling to reach lower
items such as "Set Group"; they now size to their contents (#465)</li>
</ul>
- version: "5.1.3"
type: stable
unix-timestamp: 1783555200
description:
C: >-
<p>Bug-fix release. Following 5.1.1, which restored issuer-only tokens, a database containing a token with neither an account name
nor an issuer still refused to open, and a single such token blocked every other token from loading. These anonymous tokens, common
in databases created before 5.1.0 added load-time validation, now load with a synthesized placeholder label instead of being rejected.</p>
<ul>
<li>FIX: a database (or import) containing a token with neither an account name nor an issuer refused to open on 5.1.x,
locking users out of all their tokens. Such tokens now load with a synthesized "Unknown N" label; interactive manual entry and editing
still require a name (#462, follow-up to #458)</li>
</ul>
- version: "5.1.2"
type: stable
unix-timestamp: 1783382400
description:
C: >-
<p>Bug-fix release. Screen and session locking, and locking on system suspend, now honor the Auto-Lock setting the same way the
inactivity timer already did, so with Auto-Lock off the database is no longer locked on every screen lock. The mutual exclusivity
between Auto-Lock and the Secret Service integration is restored.</p>
<ul>
<li>FIX: screensaver, session lock, and suspend now respect the Auto-Lock setting, so with Auto-Lock off the app no longer
locks and then prompts for a password on every screen lock; Auto-Lock and Secret Service are mutually exclusive again, including
reconciliation of a legacy both-on profile (#460, re-report of #279)</li>
</ul>
- version: "5.1.1"
type: stable
unix-timestamp: 1782777600
description:
C: >-
<p>Bug-fix release. Databases containing a token with an issuer but no account name (for example some ProtonMail or Steam entries)
failed to open on 5.1.0 with "Could not open database: Token has a missing label", locking users out of the entire database. Such
tokens are valid again.</p>
<ul>
<li>FIX: databases with issuer-only tokens (no account name) refused to open on 5.1.0. A token is now valid as long as it
has either an account name or an issuer; the same rule applies to imports and manual token entry (#458)</li>
</ul>
ContentRating:
oars-1.0:
violence-cartoon: none
violence-fantasy: none
violence-realistic: none
violence-bloodshed: none
violence-sexual: none
drugs-alcohol: none
drugs-narcotics: none
drugs-tobacco: none
sex-nudity: none
sex-themes: none
language-profanity: none
language-humor: none
language-discrimination: none
social-chat: none
social-info: none
social-audio: none
social-location: none
social-contacts: none
money-purchasing: none
money-gambling: none
