2FA Studio — a project by Ahsan Mahmood
Two-factor authentication management studio for secure account management
Losing the phone is how most people discover where their second factor actually lived.
A two-factor manager is a small piece of software holding something irreplaceable. Each of those factors was set up once, on a screen, months ago, and almost nobody keeps a written record of all of them anywhere else.
Two-factor authentication is the step after the password, and what makes it work is that it lives somewhere the password does not. That is also what makes it fragile, because the somewhere is usually one phone.
One phone, carried about all day.
So the interesting questions about 2FA Studio are all questions about custody.
It manages tokens across accounts, stores them, syncs them between platforms and restores them from a backup. That list is the whole product, and every item on it is a place where a mistake would be permanent rather than annoying.
Multiple accounts is the ordinary case rather than the advanced one.
Anyone with a bank, an email provider and a work login already has three. The moment there are three, the question stops being how to set one up and becomes how to move all of them at once.
Backup and restore is the feature people skip and then need.
A second factor with no recovery path turns a lost or broken handset into a set of accounts somebody else now controls the door to, and the way back in is measured in support tickets and photographs of documents. Making the codes portable is the reason to run a manager at all.
Portability is the whole point.
Sync is the same argument, made across devices instead of across time.
The web application and the Android build come out of one Capacitor codebase, with Firebase carrying an account between them. A second factor you can only reach from one device is a second factor that will be in another room at the moment somebody needs it, which is a failure mode nobody plans for and most people meet eventually.
Biometric authentication guards the application itself.
It is a local check on the device rather than proof to a server somewhere that a particular person was present at a particular moment. Those two are easy to confuse and worth keeping apart, because only one of them is a claim anybody else can rely on.
Then the part this page will not tell you.
The record I write these pages from says secure storage, and it does not say how. So this page does not describe the storage format, the key handling or the encryption, because for a credential manager those are precisely the details that must not be filled in from an assumption.
A gap beats a guess.
What it cost is caution about convenience.
Every convenience in a token manager is also a copy.
Copies are the risk.
Sync makes the codes portable and puts them somewhere other than the device. A backup makes recovery possible and creates a second thing worth stealing. A biometric gate is a lock on the front of an application whose data still lives wherever the platform puts it.
None of those trades is avoidable, and pretending otherwise is how a security product ends up over-claiming. So this page does not.
It is built with React and TypeScript on Capacitor, with Tailwind on the interface and Firebase behind the sync, and it is at 2fastudio.aoneahsan.com.
Test the restore before you need it.
That advice applies to every backup ever made, and it applies twice to the one holding the second factor for everything else you own. Do it on a quiet day.
What it does, and what that costs to build
- 2FA token management
- Secure storage
- Cross-platform sync
- Backup & restore
- Biometric authentication
Built with
- React
- TypeScript
- Firebase
- CapacitorJS
- TailwindCSS
Worth knowing
- security
- 2fa
- authentication
- mobile
Who built 2FA Studio?
Ahsan Mahmood built it, in React and TypeScript on Capacitor, with Firebase behind the sync and Tailwind on the interface. It is at 2fastudio.aoneahsan.com. Capacitor means the web application and the Android build come out of one codebase, which for a tool holding second factors matters more than it does for most products: a factor you can only reach from one particular device has a habit of being in another room on the day you need it.
What happens if the phone breaks?
You restore from a backup, which is the entire reason a manager exists rather than a default app you cannot get anything out of. A second factor with no recovery path turns a broken phone into a set of accounts you no longer control, and getting back into those is measured in support tickets and identity documents rather than in minutes. Backup and restore is the feature people skip when setting up and remember afterwards. Set it up on the first day rather than the worst one.
Can I use it on a laptop and a phone at once?
Yes, that is what the cross-platform sync is for. The same codebase produces the web application and the Android build, and Firebase carries an account between them so the tokens are wherever you happen to be working. Which is convenient and is also a decision with a cost, since anything synced is by definition somewhere other than the one device: that is the trade a token manager makes on your behalf, and it is worth understanding rather than discovering.
What does the biometric check actually protect?
The application on the device, and nothing beyond it. A biometric gate is a local check that the person holding the phone is the person enrolled on it, which is a different claim from proving anything to a server somewhere. It stops somebody holding your handset from reading what is in the application. It does not authenticate you to a website, and it is not what the one-time codes themselves are for. Those two things are easy to run together and worth keeping apart.
Does 2FA Studio work on iPhone?
No. There is no iOS half: no Apple Developer account exists here, so nothing I build has shipped to the App Store. 2FA Studio runs on the web and as an Android application, both from the same Capacitor codebase, and an iPhone can reach the web version in a browser like any other device. A code generator is exactly the kind of software where a missing platform is worth stating plainly, because finding out later means moving every token again.
https://aoneahsan.com/projects/com.aoneahsan.2fastudio