The Shift from Google Authenticator
For years, I relied on Google Authenticator without much thought. It was one of those apps that I installed once and never questioned. However, as I’ve been working on de-Googling my life, there were still some services I hadn’t completely moved away from. While using an authenticator app is definitely better than relying on SMS, the more I thought about it, the less comfortable I became with leaving something so critical in the hands of a company with a history of discontinuing products without warning.
From a security perspective, it’s a solid choice, but it felt wrong to outsource such sensitive information to a platform I’m trying to move away from. Instead of jumping to another third-party app, I decided to take a different approach: hosting my own solution.
Discovering 2FAuth
That’s when I came across 2FAuth, an open-source alternative that you can fully self-host. It supports TOTP and HOTP, which are widely used authentication protocols, and even includes support for Steam Guard codes. This makes it a versatile option for users who rely on multiple platforms.
Setting up 2FAuth is surprisingly straightforward, especially if you’re familiar with Docker or running local containers. The process involves deploying 2FAuth using Docker by grabbing the provided Docker Compose file from the project’s GitHub repository. While the setup is simple, there are a few adjustments needed in the configuration before launching the service.
Configuring 2FAuth with Docker
By default, 2FAuth runs on localhost, which is fine if you plan to use it exclusively on the device where it’s hosted. However, most users will want access to their codes on other devices, like a phone. To achieve this, a reverse proxy is necessary, allowing secure access over your network or even the internet.
Migrating from previous apps is also easy. If you’ve been using Google Authenticator or any other MFA app that supports exporting, you can import your saved tokens directly into 2FAuth. Additionally, if you’re deploying it at home, you can create multiple user accounts, enabling your family members to manage their own tokens under one shared instance.
Before deploying 2FAuth, you’ll need to make some changes to environment variables in the compose file:
- SITE_OWNER: Replace this with your email address.
- APP_KEY: Set a 32-character string. You can generate a secure key using the command
openssl rand -hex 16in your terminal. - APP_URL and ASSET_URL: Update these with the IP address or URL where you want to access 2FAuth. Ensure both fields use the same address to avoid issues with loading assets.
Once everything is configured, run the Docker Compose file, and 2FAuth should be up and running.
Using 2FAuth
The first time you open 2FAuth, it prompts you to create a new account. This is the only account you’ll need to manage all your codes. You can further secure it by adding a YubiKey or biometric verification for login. Once set up, the interface is clean, simple, and does exactly what you expect from an MFA app, with a few added bonuses.
You can start adding services by scanning the standard QR code typically used when setting up 2FA on a site. You also have the option to manually paste in the secret key or upload a QR code image if you’ve saved it from somewhere else.
If you’re migrating from a previous app, importing your existing 2FA tokens is straightforward. As long as your old app supports export (Google Authenticator does), you can easily transfer your saved entries into 2FAuth. For Steam users, there’s a dedicated mode that allows generating Steam Guard codes, eliminating the need for the official Steam mobile app.
Additional Features and Benefits
2FAuth also offers a browser extension, making it easy to view and copy OTP codes directly from your toolbar. For developers and tinkerers, it provides a RESTful API that can be used to generate, retrieve, or manage 2FA codes remotely. You can find the option to generate a secure API token in the Settings menu, allowing automation or integration into your broader self-hosted stack.
While the setup may take a few extra minutes, it’s a small price to pay for full control over your authentication data. You don’t have to worry about apps being discontinued or your codes being tied to a platform you’re moving away from. Once it’s up and running, there’s hardly any learning curve. The interface is simple, and it works great on mobile too.