Open Source Apple iPhone Authentication Apps

An open source implementation of the FIDO2 protocol to support passwordless strong authentication using public-key cryptography. Supports registration, authentication (all platforms), and transaction authorization (for native Android apps).

2FAS Auth for iOS is the official iPhone and iPad client for the 2FAS authentication platform, offering users a secure and privacy-focused mobile app to manage multi-factor authentication (MFA) tokens for their online accounts. The app generates time-based one-time passwords (TOTP) and counter-based one-time passwords (HOTP) that are widely required for logging into services with enhanced security, and it lets users scan QR codes or manually enter secret keys to register new accounts. Designed with native iOS conventions, it supports Face ID and Touch ID to quickly unlock the app while keeping authentication secrets encrypted locally on the device, so sensitive data never leaves the user’s control. The client is also structured to work offline, meaning you can generate codes without a network connection, and it integrates with companion browser extensions or other 2FAS sync tools so tokens can be backed up or restored across devices securely.

The nativescript-fingerprint-auth plugin enables biometric authentication in NativeScript applications, allowing users to authenticate using fingerprint or facial recognition, enhancing security and user convenience.

Proton Authenticator for iOS is the official two-factor authentication client for iPhone and iPad, providing secure generation and management of TOTP codes for users’ online accounts while prioritizing privacy and encrypted secrets storage. Written in Swift with native iOS APIs, it supports scanning QR codes to add new authentication tokens, auto-sorting entries, and fast entry selection, all within a sleek, responsive iOS interface. The application encrypts secrets on the device and uses Proton’s encrypted sync service if enabled so that users can recover or replicate their authentication tokens across devices without compromising security. It integrates with iOS features like Face ID and Touch ID to protect access to the app and tokens, ensuring only authorized users can view or generate verification codes. The repository’s open-source nature helps security professionals and auditors inspect core logic related to cryptography and token workflow.

Raivo OTP’s iOS application is a native, secure, and user-friendly two-factor authentication (2FA) client that generates time-based (TOTP) and counter-based (HOTP) one-time passwords to protect accounts, all built specifically for iOS devices using modern Swift. It helps users replace or supplement traditional SMS or email 2FA by securely storing OTP secrets and displaying rotating codes that can be synced via iCloud across Apple devices, reducing the risk of losing access when switching devices. Users can easily add new accounts by scanning QR codes or entering secrets manually, assign custom icons for better visual organization, and quickly search through stored tokens to find the one they need. The app includes optional biometric unlocking with Face ID or Touch ID so access to sensitive OTPs remains both fast and secure. It also supports encrypted backups and exports, letting users archive their data safely offline or transfer it between devices.

Satellizer is a simple to use, end-to-end, token-based authentication module for AngularJS with built-in support for Google, Facebook, LinkedIn, Twitter, Instagram, GitHub, Bitbucket, Yahoo, Twitch, Microsoft (Windows Live) OAuth providers, as well as Email and Password sign-in. However, you are not limited to the sign-in options above, in fact you can add any OAuth 1.0 or OAuth 2.0 provider by passing provider-specific information in the app config block. With any Cordova mobile apps or any framework that uses Cordova, such as Ionic Framework, you will need to add cordova-plugin-inappbrowser plugin. Make sure that inAppBrowser is listed in your project. Authorization (obtaining user's information with their permission) and authentication (application sign-in) requires sever-side implementation.