Help

Using DeskAuth

• Click Add to add an authenticator from a secret key, an otpauth:// link, or a QR code image.
• Double-click an authenticator, or select it and press Ctrl+C, to copy its code.
• Authenticators that don't show their code automatically have a refresh button. Click it to show the code for 10 seconds.
• Right-click an authenticator to rename it, change its icon, set a password, assign a shortcut key, show its secret key, or delete it. Press F2 to rename and Delete to delete.
• Drag authenticators to change their order.
• Click the gear button for options, protection, import and export.

Time-based and counter-based codes

Most websites use time-based codes (TOTP), which change every 30 seconds. The ring next to the code shows how long it has left. Some, such as VPN tokens, use counter-based codes (HOTP), which change each time you use one; DeskAuth only shows these when you click.

Time-based codes depend on your computer's clock. If codes are rejected, check that Windows is set to set the time automatically.

Protecting your authenticators

Choose Change protection from the gear menu. You can use any combination of:

• Your own password. DeskAuth asks for it each time it starts. This is strongly recommended: without it, any program running as you could read your secret keys.
• Encrypt so it can only be used on this computer, and optionally only by the current Windows user. This uses Windows' own data protection, so the file can't be opened if it is copied elsewhere.

You can also set a password on individual authenticators from their right-click menu. DeskAuth asks for it each time you show that authenticator's code.

Backing up your authenticators

If you lose your authenticators you may be locked out of your accounts, so keep a backup. You can:

• Save the backup or recovery codes each website gives you when you turn on two-factor authentication. This is the most reliable way to get back into an account.
• Choose Export from the gear menu. This saves a text file of otpauth:// links that DeskAuth and most other authenticator apps can import. The file is not encrypted, so keep it somewhere safe, such as an encrypted drive or a password manager.
• Right-click an authenticator and choose Show secret key, then write down the key or scan the QR code with an authenticator app on your phone.
• Copy your deskauth.xml file. If it is locked to this computer or Windows account, a copy will only open there, so also use one of the other methods.

Lost or forgotten password

When you protect DeskAuth with a password, or lock it to your computer or Windows account, your authenticators are encrypted with keys made from those. There is no password recovery and no way to decrypt them without the password or the original Windows account. This can happen if you:

• forget your password
• reinstall Windows, or move to a new computer, without removing the "only on this computer" protection first

If this happens, you will need to:

1. Import a backup you exported, or add authenticators again from secret keys you saved.
2. For any account you can't restore, sign in using the website's backup or recovery codes, or its account recovery process, then turn two-factor authentication off and on again to get a new secret key.

Where are my authenticators saved?

In %APPDATA%\DeskAuth\deskauth.xml, usually C:\Users\you\AppData\Roaming\DeskAuth\deskauth.xml. Each time DeskAuth saves, it keeps the previous version as deskauth.xml.bak.

DeskAuth uses a different file if:

• there is a deskauth.xml, or WinAuth's winauth.xml, in the same folder as DeskAuth.exe (portable mode), or
• you give a file on the command line: DeskAuth.exe "D:\path\to\deskauth.xml".

Choose About from the gear menu to see which file is in use. The file is never sent anywhere.

Shortcut keys and the system tray

Right-click an authenticator and choose Shortcut key to assign a key combination such as Ctrl+Alt+G. It works from any program, and can type the code into the current window, copy it, or show it in a notification. If another program already uses the combination, DeskAuth tells you so you can choose another.

Turn on Use system tray icon in the gear menu to keep DeskAuth in the notification area. Closing or minimizing the window then hides it to the tray. Click the tray icon to show DeskAuth, or right-click it to copy any code. Start with Windows starts DeskAuth in the tray when you sign in.

Import and export

DeskAuth imports and exports text files with one otpauth:// link per line, the format used by most authenticator apps, for example:

otpauth://totp/GitHub:alice?secret=JBSWY3DPEHPK3PXP&issuer=GitHub
otpauth://hotp/VPN?secret=GEZDGNBVGY3TQOJQ&counter=12

Blank lines and lines starting with # are ignored. Exports from WinAuth 3 can be imported if they were saved as plain text; for encrypted zip or PGP exports, export again from WinAuth 3 as a text file first.

Upgrading from WinAuth

DeskAuth is a rewrite of WinAuth 3 for modern Windows. The first time it runs, it copies your authenticators from WinAuth's %APPDATA%\WinAuth\winauth.xml to %APPDATA%\DeskAuth\deskauth.xml, keeping their protection. Your WinAuth file is not changed, but DeskAuth saves in a stronger format that WinAuth 3 cannot read, so changes in one don't appear in the other.

• Only standard time-based and counter-based authenticators are supported. These work with almost every website, including Microsoft, Google and Okta accounts. Battle.net, Steam, Guild Wars 2, Glyph and other service-specific authenticators are shown as not supported. Move them to their official apps, then delete them from DeskAuth.
• YubiKey protection is no longer supported. Remove it using WinAuth 3 before upgrading.
• DeskAuth uses your computer's clock and no longer checks the time online.
• Export saves a plain text file. Encrypted zip and PGP exports and the registry backups have been removed.
• Shortcut keys type, copy or show the code. Advanced shortcut scripts now type the code.

Updating DeskAuth

When DeskAuth starts, it checks for a new version and shows a message at the top of its window if there is one. Beta versions are never offered. Click Download the new version, download the file for your PC, and replace your existing DeskAuth.exe with it. Your authenticators and settings are kept, because they are stored separately. To stop checking, untick Check for updates in the options menu (the gear button).

Is it secure?

Any authenticator adds a second layer of security to your accounts, but none is perfect. A separate device, such as a phone or a hardware security key, is safer than an app on the computer you sign in from, because malware on that computer can't reach it.

DeskAuth keeps your secret keys encrypted on your computer and never sends them anywhere. To keep them safe:

• protect DeskAuth with a strong password
• keep Windows up to date and free of malware
• only download DeskAuth from the GitHub releases page

DeskAuth is open source, so anyone can review the code or build it themselves.

See the privacy notice for what the app and this website collect.

Reporting a problem

Please open an issue on GitHub with what you did, what happened, and your Windows version. Never include your secret keys, passwords or deskauth.xml file.