Tofu

An easy-to-use, open-source two-factor authentication app designed specifically for iOS.

Download on the App Store

Features

  1. Scanning

    Scan the QR code your issuer provides to automatically add your account.

  2. Search

    Search your accounts by name to quickly find the one you're looking for.

  3. Compatibility

    Support for both counter-based and time-based one-time passwords with 6 or 8 digits using the SHA1, SHA256, and SHA512 algorithms.

  4. Offline

    Requires no network or cellular connection and can be used in airplane mode.

  5. Security

    All your account details are safely stored in the iOS keychain.

About

Tofu generates one-time passwords to help you protect your online accounts. These passwords are used together with your normal password when you sign into services like Google, Facebook, Dropbox, Amazon, and GitHub.

Tofu works with all services that provide two-factor authentication using the HOTP and TOTP algorithms. It does not require a network or cellular connection and can be used in airplane mode.

Tofu is open source and free software licensed under the ISC license. The source code is available for review and modification on GitHub.

FAQ

What is two-factor authentication?

Two-factor authentication requires you to provide two separate means of identification when you sign into your online accounts. One is commonly something you know, e.g. your password, and one is something you possess, like your iPhone.

Using two-factor authentication requires someone to have both your password and your iPhone to get into your account. This makes your account much harder to hack and hijack.

Many online services provide two-factor authentication by requiring you to enter a one-time password in addition to your normal username and password. To generate this password, a shared secret is required. Tofu stores this secret securely in your iPhone's keychain and generates the password for you.

What is the difference between two-factor authentication, 2FA, and two-step verification?
There is no difference. They all refer to the same concept.
How do I prevent being locked out of my account if I lose access to my iPhone?

Online services that support two-factor authentication generally provide so called backup or recovery codes during the setup process. If you lose access to your iPhone, you can use one of these codes instead of the one-time passwords generated by Tofu. It is really important to keep these safe. We recommend either printing them on paper to store somewhere safe, or saving them in a password manager such as 1Password.

As a secondary level of protection, accounts in Tofu are also included in iOS backups. To be able to restore these on a new iPhone, backups must be made using iTunes or Finder on the Mac, and have to be password protected. Tofu's accounts will not migrate to a new iPhone, when restoring from an iCloud backup. This is true for all apps that store accounts in the iOS Keychain and there's currently no way for us to affect this. We hope Apple will change how iOS backups work in the future.

How do I move my accounts to a new iPhone?
The only automated way of moving your Tofu accounts to a new iPhone is to restore a password protected backup of the old iPhone made with iTunes or Finder on the Mac. It is also possible to manually deactivate and then re-activate two-factor authentication for each of your accounts, scanning the new QR codes using Tofu on the new iPhone.

Help

Do you need help or have a question which isn't answered in the FAQ section above? Send me an email on calle@hey.com and I'll do my best to get back to you as soon as possible.

You can also file an issue or submit a pull request on GitHub.