Skip to content
Tessera
Local-first · Open source

Two-factor codes
you actually own.

Tessera keeps your 2FA codes in an encrypted vault on your Mac, reachable from a native app and a real command line. No account, and no server to trust.

Get Tessera </> Read the source
  • Apache-2.0 licensed
  • argon2id + XChaCha20
New to 2FA?

A second key,
just for you.

A password can be guessed, leaked, or phished. Two-factor authentication adds a second step that a thief can't fake: a six-digit code that changes every 30 seconds and only your device can produce.

Even if someone has your password, they can't get in without that code. Tessera is where your codes live: offline, and only yours.

How to set it up
Anatomy of a code
{ } GitHub the issuer
824 159
your six-digit code, right now
rolls in 18s
What's inside

Everything. Including the command line.

Touch ID, auto-launch, HOTP, Steam Guard, and bulk import. Plus the one thing dedicated Mac authenticators almost never ship: a real command line.

01

Works with any TOTP service

Standard TOTP, plus HOTP and Steam Guard.

02

Move in, in minutes

Import from Google Authenticator, paste otpauth links, or scan a QR. One account or a hundred at once, nothing to retype.

03

Scan from the screen

Point the app at a QR code on your display and it reads it. The CLI reads QR images straight from a file.

04

A real command line

Lists, watches, and copies codes.

05

Open with Touch ID

Your vault key can be sealed by the Secure Enclave. Turn on Require Touch ID and the key won't open without your fingerprint.

06

Encrypted on your device

A random key encrypts every secret with XChaCha20-Poly1305, wrapped by the Secure Enclave on a Mac or by an argon2id key from your passphrase. Plain secrets never touch disk.

The command line

For people who live in the terminal.

tess is the same vault, fully scriptable, with JSON output and shell completions.

  • tess add add an account from an otpauth link or QR
  • tess print current codes with countdown bars
  • tess watch live view: search, copy, refresh
  • tess code github -c copy one code to the clipboard
tess watch
$ tess watch
◧ Tessera5 accounts
github 824 159
google 317 042
cloudflare 660 318
steam K7M T2
aws 471 962
↑/↓ move · enter/c copy · / search · q quit
Why you can trust it

Security you can read.

A 2FA app holds the keys to your accounts, so it has to earn that trust. Tessera does it in the open.

Open and auditable

Apache-2.0, end to end. The CLI and app share one documented vault format, checked byte-for-byte against a public test suite. Build it and verify it yourself.

github.com/ibrahemid/tessera →

Local-first by default

Codes are generated entirely offline. There's no Tessera account and no Tessera server, so there's no central database of your secrets to breach or subpoena.

No tracking

No analytics or crash SDKs. Apple's privacy label reads Data Not Collected. This site ships no trackers.

The crypto, plainly

A random 256-bit key encrypts your accounts with XChaCha20-Poly1305. Each unlock method wraps that key on its own: the Secure Enclave on a Mac, and a key derived from your passphrase with argon2id. Touch ID can gate the Secure Enclave wrap. Two independent builds, Go and Swift, prove they read the same vault on every change. Secrets live as raw bytes; they're never logged.

Where it runs

macOS first, portable by design.

macOS is the first home. The vault format and the CLI are cross-platform already, so a phone app starts from a working core rather than from scratch.

macOS app Now

Native Mac app with Touch ID, on the Mac App Store.

Command line Now

The tess CLI runs today. Written in Go, it builds anywhere Go does.

iPhone Planned

The same vault, in your pocket. On the roadmap, not yet shipped.

Android Planned

The same vault on Android. On the roadmap, not yet shipped.

Pricing

All of it. For nothing.

Every feature, the app and the CLI, free. There's no upgrade to buy. Your codes stay yours.

  • Touch ID unlock
  • The tess CLI, HOTP, Steam Guard
  • Bulk import & QR
  • Encrypted local vault
Get Tessera

Two ways in.

Download the Mac app from the App Store, or install the CLI with a single command.

Command line

Install with Go, then create a vault and watch your codes.

terminal 
$ go install github.com/ibrahemid/tessera/go/cmd/tess@latest
$ tess vault init
$ tess watch

Needs Go 1.26+. Vault: ~/.local/share/tessera/vault.json

macOS app

Native Mac app with Touch ID, on-screen QR scanning, folders, and one-click copy.

Download on the
Mac App Store

Sandboxed, and opens the same vault you built in the terminal.