2FA Authenticator with Encrypted Backup & Restore

A TOTP app holds a shared secret for each account and uses it to compute a short code that changes every 30 seconds, following the RFC 6238 standard. When a website asks for your two-factor code, you read the current value from the app. Keyring computes these codes entirely on your iPhone — no server involved — and shows a countdown ring so you know how long each code remains valid.

The tokens have to move with their secrets, which is where most people get burned — codes do not transfer with a basic phone migration unless the authenticator supports it. With Keyring's encrypted iCloud sync turned on, signing into iCloud on the new phone restores every token automatically. If you prefer a manual route, the passphrase-protected export file can be moved and imported like any document.

Without a backup, the secrets are gone and you must recover each account through its own reset process — which can take days per service. Keyring is built to make that scenario a non-event: encrypted iCloud sync means a replacement iPhone gets every token back, and the encrypted export file covers you even if you leave the ecosystem. It is still wise to keep each service's recovery codes somewhere safe.

Keyring offers two paths. Encrypted iCloud sync stores tokens in your private iCloud, protected so that only your devices can read them, and restores automatically on a new phone. Separately, you can create a manual export file wrapped with a passphrase you choose — a self-contained backup you can keep in any storage you trust.

Keyring's sync is opt-in and end-to-end protected: secrets are encrypted before they leave the device, live in your private iCloud database, and are unreadable without your own devices and credentials. On the phone itself, secrets sit in the iOS Keychain gated by Face ID or your passcode. If you prefer, you can skip sync entirely and rely on the encrypted export file.

Yes, at any time. Keyring produces a passphrase-encrypted export file containing all your tokens, which you can store or move wherever you like and re-import later. You are never locked in: the export path exists precisely so your access to your own accounts never depends on any one app or cloud.

Most services show a QR code when you enable two-factor authentication in their security settings. In Keyring you scan that code with the camera and the account appears with its issuer name filled in. If there is no QR code, you can paste an otpauth link or type the secret key manually — all three end up as the same standard token.

Yes. Keyring reads standard otpauth migration files and encrypted backup exports, bringing your accounts over in bulk instead of one QR scan at a time. Issuer names, labels, and settings carry across, so a switch takes minutes even with dozens of accounts.

Yes — that is one of their core advantages over SMS codes. TOTP codes are computed from the stored secret and the current time, so no network is needed at all. Keyring generates codes in airplane mode, abroad without a data plan, or anywhere else your phone has a clock.

SMS delivers a code over the phone network, which can be intercepted or hijacked through SIM-swap attacks and fails without signal. An authenticator app computes the code on the device from a secret that never travels, making it both more secure and available offline. Security guidance broadly recommends app-based codes over SMS where a service offers both.

Yes. Keyring includes an Apple Watch complication and a home-screen widget so your most-used codes are a glance away during a login. Both are shipped and maintained as first-class parts of the app, not afterthoughts.

Keyring's search filters as you type, matching issuer names and your own custom labels, including names written in any script. You can also reorder tiles and label accounts however you think of them — so the code you need during a checkout is two keystrokes away, not a scroll through a wall of entries.