A free, open-source, local-first two-factor authentication (2FA) manager and TOTP authenticator app that runs on your own computer. Built with Go and Vue 3 — a privacy-friendly alternative to Authy, Google Authenticator, and other cloud 2FA apps.
CVE2fa is a local, self-hosted two-factor authentication (2FA) manager for generating TOTP (Time-based One-Time Password) codes — the same standard used by Google Authenticator, Authy, and Microsoft Authenticator. Instead of trusting a third-party cloud app with your 2FA secrets, CVE2fa runs entirely on your own computer, with encrypted local storage and encrypted backups.
It's a single self-contained binary with an embedded Vue 3 web UI, backed by a local SQLite file — no external database, no cloud account, no telemetry.
- Full control — your TOTP secrets never leave your own machine.
- No vendor lock-in — encrypted export/import means your data is portable.
- Open source — inspect exactly how your secrets are stored and encrypted.
- Lightweight — one Go binary, one local SQLite file, no external dependencies at runtime.
- 🔑 Generate TOTP codes for unlimited accounts (Google, GitHub, AWS, etc.)
- 🔒 AES-256-GCM encrypted backup & restore, keys derived with Argon2id
- 📦 Encrypted import/export in a portable
.2fadataformat - 🌙 Dark-mode UI built with DaisyUI + Tailwind CSS
- 🪪 JWT-based session authentication
- 🗄️ SQLite database — deploys as a single executable file
- 🖥️ Runs anywhere: Linux, macOS, Windows
# Clone the repository
git clone https://github.com/cveburak/CVE2FA.git
cd CVE2FA
# Build the frontend
cd web && npm install && npm run build && cd ..
# Build the server
go build -o CVE2fa .
# Run it
./CVE2faDefault login: admin / admin (you'll be asked to change it on first login)
Runs locally at: http://localhost:2026
| Method | Path | Description |
|---|---|---|
| POST | /api/auth/login | Authenticate |
| POST | /api/auth/logout | End session |
| PUT | /api/auth/password | Change password |
| GET | /api/auth/me | Current user |
| GET | /api/accounts | List accounts |
| POST | /api/accounts | Add account |
| DELETE | /api/accounts/{id} | Remove account |
| GET | /api/accounts/{id}/code | Generate TOTP code |
| POST | /api/export | Export encrypted backup |
| POST | /api/import | Import encrypted backup |
- All sensitive account data is encrypted with AES-256-GCM before it's written to the database
- Passwords are hashed with Argon2id
- Session tokens are signed with HMAC-SHA256 (JWT)
- Backup files are encrypted with a key derived from your master password
| Layer | Technology |
|---|---|
| Backend | Go |
| Frontend | Vue 3, Tailwind CSS, DaisyUI |
| Database | SQLite |
| Auth | JWT (HMAC-SHA256) |
| Encryption | AES-256-GCM, Argon2id |
Issues and pull requests are welcome. If you run into a bug or have a feature request, please open an issue on GitHub.
This project is licensed under the MIT License — free to use, modify, and distribute, with attribution.
Keywords: local 2FA manager, self-hosted TOTP manager, open source authenticator app, Google Authenticator alternative, Authy alternative, Go 2FA app, Vue 3 authenticator, offline authenticator app