Are you tired of being locked out of your accounts when you reset your phone? I was. I wanted a 2FA authenticator that would sync my codes seamlessly across devices, but I didn't want to hand over my plaintext secrets to a closed-source cloud provider.
So, I built OtpVault — an open-source, truly zero-knowledge 2FA application.
In this post, I want to share the architecture, the tech stack, and how I approached the security model.
To make this work across Desktop (Windows), Android, and the Web (PWA), I needed a flexible yet highly secure stack:
Backend / Core Logic: Rust (Using aes-gcm, argon2, and totp-rs). Rust ensures memory safety and handles the heavy cryptographic lifting.
