Help, and how it works.
Tessera is open source and maintained on GitHub. The fastest way to report a bug or ask a question is to open an issue; for anything private, email works.
New to 2FA? Three steps.
Pick where your codes live
Open the app and it creates a vault sealed by your Mac's Secure Enclave. In the terminal, run tess vault init and choose a passphrase you'll remember: it's the one thing that can't be reset. The app can take a passphrase too, under Settings → Recovery passphrase.
Bring your accounts in
On a site's security page, choose “authenticator app.” Scan the QR with the app, or paste the otpauth link. Moving from Google Authenticator? Export and import the whole set at once.
Use a code when asked
When a site asks for a 2FA code, open Tessera, copy the six digits for that account, and paste. They refresh every 30 seconds, so grab the current one.
Common questions
How do I import my existing accounts?
From Google Authenticator: Transfer accounts → Export, then scan the QR (app) or run tess import --migration "otpauth-migration://…". You can also paste otpauth links or import a file of many at once.
Where are my codes stored?
In an encrypted vault on your Mac. The app keeps it in its sandbox container; the CLI keeps it at ~/.local/share/tessera/vault.json. To use one vault for both, choose “Open existing vault…” in the app and pick the CLI's file; the app remembers it.
I forgot my passphrase.
The vault can't be decrypted without it. That's the point. Keep a backup with tess export --file backup.json and store your passphrase somewhere safe, like a password manager.
Can I use it on more than one Mac?
Yes. Move a vault between machines with tess export --file backup.json, then tess merge backup.json on the other side. For the CLI to open the app's own vault, set a recovery passphrase in the app's settings, then point TESSERA_VAULT or --vault at that file.
Is it really free?
Yes. Apache-2.0 licensed, nothing to buy.
Which services work with Tessera?
Any service that offers an authenticator app (TOTP), plus HOTP and Steam Guard. If you can scan its QR or copy its setup link, Tessera can hold it.