package icon

Clockwork: 2FA Authenticator

Offline 2FA authenticator: TOTP codes, no network permission, no accounts.
New in version 2.0.1
Clockwork 2.0 is a native Android app, rewritten in Kotlin and Jetpack Compose — no browser engine any more.

• Android 8.0 or newer. On Android 7, 1.5.4 stays the final version.
• An existing vault is carried over on update — nothing to export, nothing to type again.
• Unlock with your fingerprint. The passphrase stays the only way back in.
• Still no INTERNET permission.
Clockwork is a two-factor authenticator (2FA) that generates TOTP codes entirely on your device. It declares no INTERNET permission at all — the app cannot open a connection, and you can check that in the manifest before you believe a word of this.

That is the difference. Most authenticator apps hold network access for sync, service icons or update checks. Clockwork does not have the permission, so the question never comes up.

WHAT IT DOES
• Generates TOTP codes (RFC 6238) — SHA-1, SHA-256 or SHA-512, 6 to 8 digits, any period.
• Add accounts the way you happen to have them: scan a QR code, import a QR image, paste an otpauth:// link, or type a Base32 secret. A full Google Authenticator export is converted automatically.
• A dial with 30 marks and a moving hand shows the time left — a position you read at a glance, not a shrinking bar.
• One tap copies the code, and the next one is on screen before it becomes valid.
• Broken input is explained line by line, never silently swallowed.

YOUR SECRETS STAY YOURS
• By default nothing is stored at all. Close the app and the secrets are gone.
• Switch the vault on and they stay here, encrypted with your passphrase: AES-256-GCM, key derived by PBKDF2-SHA-256 with 600,000 iterations. Only the sealed envelope is written to disk — never the plaintext, never the passphrase, never the derived key.
• Unlock with your fingerprint if you want to. The passphrase stays the only way back in.
• Locks automatically after a time you choose and when you leave the app. Screenshots and preview images can be blocked.
• Android backup is switched off, so the encrypted vault never leaves the device.

PRIVACY
Nothing is collected, because there is nowhere for it to go. No analytics, no telemetry, no update pings, no advertising identifiers, no accounts, no ads. The camera permission serves the QR scanner alone and is declared optional hardware — importing a QR image works without it.

BUILT TO BE CHECKED
Open source under the MIT licence. The OTP algorithms are written from scratch against the RFC test vectors — no OTP library. Source code, test suite and the measurement scripts behind every claim above are public at github.com/keco216/clockwork.

Speaks 37 languages, all bundled, including right-to-left layouts.

Android 8.0 or newer. On Android 7, 1.5.4 stays the final version.

One thing, independent of this app: set up backup codes with every provider before you rely on any authenticator. They are the only thing that gets you back in when a secret is gone.
  • app screenshot
  • app screenshot
  • app screenshot
  • app screenshot
  • app screenshot
  • app screenshot
  • app screenshot

Versions

Although APK downloads are available below to give you the choice, you should be aware that by installing that way you will not receive update notifications and it's a less secure way to download. We recommend that you install the F-Droid client and use that.

Download F-Droid
  • Version 2.0.1 (20001) suggested Added on Aug 19, 2026

    arm64-v8a armeabi-v7a x86 x86_64

    This version requires Android 8.0 or newer.

    It is built and signed by F-Droid, and guaranteed to correspond to this source tarball.

    Permissions
    • take pictures and videos
      This app can take pictures and record videos using the camera while the app is in use.
    • use biometric hardware
      Allows the app to use biometric hardware for authentication
    • use fingerprint hardware
      Allows the app to use fingerprint hardware for authentication
    • io.github.keco216.clockwork.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

    Download APK 3.2 MiB PGP Signature | Build Log

    • New in version 1.5.4
    The app is unchanged. This reverts a build flag from 1.5.3: PNG recompression is enabled again, which shrinks the APK by 53 kB. It had been switched off to make the build reproducible, on the assumption that the icons this project generates itself are deterministic — they are only so on the same Node version, and disabling the recompression exposed that instead of hiding it. Reproducibility against F-Droid's build server has not been reached and is not claimed.
  • Version 1.5.4 (10504) - Added on Aug 14, 2026

    This version requires Android 7.0 or newer.

    It is built and signed by F-Droid, and guaranteed to correspond to this source tarball.

    Permissions
    • take pictures and videos
      This app can take pictures and record videos using the camera while the app is in use.
    • io.github.keco216.clockwork.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

    Download APK 1.2 MiB PGP Signature | Build Log

    • New in version 1.5.3
    The app is unchanged. This release was an attempt to make the build byte-for-byte reproducible, so that F-Droid could ship the APK published here instead of its own: the ART baseline profile and AAPT2's PNG recompression were switched off, both being sources of byte-level noise. The attempt failed — the toolchains still differ, and disabling PNG recompression made it worse while costing 53 kB. Version 1.5.4 reverts that part. Reproducibility is not claimed.
  • Version 1.5.3 (10503) - Added on Aug 13, 2026

    This version requires Android 7.0 or newer.

    It is built and signed by F-Droid, and guaranteed to correspond to this source tarball.

    Permissions
    • take pictures and videos
      This app can take pictures and record videos using the camera while the app is in use.
    • io.github.keco216.clockwork.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

    Download APK 1.3 MiB PGP Signature | Build Log

Find Apps