{
  "id": 2866922,
  "title": "How I Built a Zero-Knowledge 2FA Authenticator Using Rust, Tauri, and React",
  "url": "https://urgent.news/2026/08/23/how-i-built-a-zero-knowledge-2fa-authenticator-using-rust-tauri-and",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-23T20:24:04.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/euromoscow/how-i-built-a-zero-knowledge-2fa-authenticator-using-rust-tauri-and-react-1co6"
  },
  "original_language": "en",
  "account": "Tired of losing access to your accounts when you change devices? OtpVault provides a solution to the 2FA authenticator challenge by offering an open-source, zero-knowledge approach. This post details its architecture and technology choices.\n\nThe project leverages Rust for the backend logic, utilizing cryptography libraries like aes-gcm, argon2, and totp-rs. These libraries ensure memory safety and handle the cryptographic tasks with efficiency. The Tauri framework enables the seamless integration of the Rust backend with native web frontends for desktop and Android platforms.\n\nReact 19, Vite, and Tailwind CSS power the frontend development, providing an interactive user interface. Neon PostgreSQL, deployed via Vercel Serverless, serves as the cloud API. The security model of OtpVault is built around zero-knowledge principles, ensuring that the server never has access to plaintext data.\n\nThe email-based authentication flow is designed to maintain security and privacy. During sign-up or login, the user's password and a randomly generated 32-byte salt are combined with Argon2id on the client side, resulting in a robust 256-bit AES key. This key is used to encrypt the entire vault of 2FA secrets locally using AES-256-GCM.\n\nFor cross-platform synchronization, a real-time polling mechanism is employed, checking for updates every 10 seconds. The Rust HTTP client fetches the encrypted vault from the Vercel API, decrypts it in memory, and then merges any new accounts or updates. The Android version of the application uses base64-salt-plus-nonce-plus-ciphertext format, while the PWA version handles secrets in memory before re-encrypting the entire vault. This process ensures that encrypted vault blobs are sent to the server, leaving the attacker with meaningless encrypted data if the database ever gets compromised.\n\nTo prevent accidental deletions, users must re-enter their master password before removing any 2FA account from the vault. The mobile QR scanner utilizes jsQR and requestAnimationFrame for efficient scanning, optimizing battery usage and processing power with a low JPEG quality setting of 30KB per frame.\n\nOtpVault's commitment to security extends to its deletion confirmation feature, which requires the master password before any 2FA account can be removed. This helps avoid accidental deletions of critical security information.\n\nFor those interested in exploring OtpVault, its GitHub repository is available at https://github.com/Shadow132245/OtpVault, and the web application can be tried out at https://otpvault1.vercel.app. The author welcomes feedback, feature requests, and contributions to improve the application's robustness and usability.",
  "summary": "Are you tired of being locked out of your accounts when you reset your phone? I was. I wanted a 2FA authenticator that would sync my codes seamlessly across devices, but I didn't want to hand over my plaintext secrets to a closed-source cloud provider. So, I built OtpVault — an open-source, truly zero-knowledge 2FA application. In this post, I want to share the architecture, the tech stack, and…",
  "key_points": [
    "OtpVault offers zero-knowledge 2FA authenticator solution",
    "Rust backend uses cryptography libraries like aes-gcm, argon2, and totp-rs",
    "React 19, Vite, and Tailwind CSS power frontend development"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}