Terms of Service

By creating an account and using OtpVault — on Windows, Android, or the browser PWA — you agree to these Terms of Service. If you do not agree, please do not use the service.

OtpVault is a two-factor authentication (2FA) app that stores your TOTP secrets in a zero-knowledge encrypted vault. It runs natively on Windows (MSI), on Android (APK), and in any modern browser (PWA). Optional cloud sync backs up your encrypted vault across your devices.

You are responsible for keeping your email and password confidential, and for all activity that happens under your account. Because OtpVault is zero-knowledge, your password cannot be recovered or reset by anyone — if you lose it, your encrypted vault is unrecoverable. Keep it safe.

Your vault is protected with AES-256-GCM, with the key derived from your password using Argon2id. On Android you may optionally unlock with fingerprint/face via the system BiometricPrompt. You are responsible for controlling who can use your device and your biometrics to unlock the vault.

You agree not to misuse the service, attempt to disrupt it, abuse the cloud sync endpoints, or use OtpVault for any unlawful purpose. You also agree not to attempt to extract other users' data from the service.

OtpVault is updated through GitHub Releases. On Windows and Android, in-app update prompts install the latest official version. Cloud sync requires an internet connection; core TOTP generation works fully offline.

OtpVault is open-source software released under the MIT license. The entire source code is public on GitHub — you may review, compile, and verify every build yourself.

OtpVault is provided "as is" without warranty of any kind, express or implied. The developers are not liable for any damages arising from the use of this software, including but not limited to lost account access, data loss, or missed codes.

We may update these terms from time to time. Changes are announced through the app and the repository. Continued use of the service after changes take effect constitutes acceptance of the new terms.

We may suspend or terminate an account that violates these terms or disrupts the service. You may stop using OtpVault at any time and delete your account — including all associated data — directly from the app.