Duo Mobile (Cisco Duo)

Best Self Hosted Alternatives to Duo Mobile (Cisco Duo)

A curated collection of the 2 best self hosted alternatives to Duo Mobile (Cisco Duo).

Mobile app for Cisco Duo multi-factor authentication. Delivers push approval notifications, generates TOTP/passcodes, manages trusted devices and account settings, and provides device-based authentication for securing user logins to applications, VPNs, and corporate resources.

Alternatives List

#1
2FAuth

2FAuth

Open-source web app to manage TOTP/HOTP 2FA accounts: scan QR codes, generate one-time codes, import/export tokens, and protect access with WebAuthn and optional encryption.

2FAuth screenshot

2FAuth is an open-source web application that manages Two-Factor Authentication (2FA) accounts and generates one-time passwords (TOTP/HOTP). It provides a browser-accessible interface, QR-code scanning, import/export tools, and optional data encryption with modern authentication support.

Key Features

  • Generate TOTP and HOTP (and Steam Guard) one-time passwords according to standard RFCs
  • Add accounts via QR code scanning, manual advanced form, or import from other authenticator formats
  • Organize accounts using Groups and edit or delete entries
  • REST API to perform most app functions from external applications
  • Modern authentication options including WebAuthn (security keys) and auto-lock/session timeout controls
  • Optional encryption for sensitive data at rest (requires backing up application key)
  • Browser companion extensions and PWA support to surface OTPs from a running instance

Use Cases

  • Centralized access to 2FA codes on desktop or shared devices when a phone is unavailable
  • Family or small-team shared instance for managing multiple members' 2FA accounts with per-account organization
  • Migration and backup of existing authenticator data using import/export to move between apps or restore tokens

Limitations and Considerations

  • Data encryption is optional and disabled by default; enabling encryption requires safeguarding the APP_KEY backup to avoid data loss
  • Browser extensions and companion tools require a running 2FAuth instance and are not standalone; this may limit offline use
  • Correct operation depends on a properly configured server environment (PHP/Laravel requirements) and secure database backups to protect stored secrets

2FAuth is focused on providing a standards-compliant, auditable, and UI-friendly way to manage OTP-based 2FA tokens for desktop and mobile web access. It emphasizes privacy, portability of data, and flexible deployment options.

3.7kstars
260forks
View Details
#2
Zero-TOTP

Zero-TOTP

Open-source TOTP client and encrypted vault using zero-knowledge encryption to store, sync and retrieve TOTP secrets via web, rescue frontend, iOS and CLI; self-hostable.

Zero-TOTP screenshot

Zero-TOTP is a self-hostable TOTP client and encrypted vault that uses zero-knowledge encryption to protect TOTP secrets. It provides a web application (primary), a minimal rescue frontend, and companion iOS and CLI clients, with options to replicate encrypted vaults across multiple storage locations.

Key Features

  • Zero-knowledge encryption: vaults are encrypted client-side so only the passphrase can decrypt secrets
  • Multi-platform access: main web app, minimal rescue frontend, iOS app and CLI (projects at different maturity levels)
  • Multiple storage replication: support for storing encrypted vaults in several locations to ensure availability
  • Self-hostable deployment: provided as containerized components for on-prem or private hosting
  • Focused TOTP management: create, store and retrieve time-based one-time passwords securely

Use Cases

  • Centralize and protect TOTP secrets for personal or small-team use while retaining key control
  • Emergency access via the rescue frontend when primary hosting is unavailable
  • Self-hosted alternative to commercial authenticator services requiring vault replication and recovery

Limitations and Considerations

  • Mobile and CLI clients are not the primary focus and are not actively developed to the same maturity as the web app
  • Loss of the passphrase results in permanent loss of access to encrypted vaults; users must manage passphrases and backups carefully

Zero-TOTP is suited for users who need a privacy-focused, self-hostable TOTP solution with client-side encryption and multiple replication options. It emphasizes control and recoverability over hosted convenience.

15stars
0forks
View Details

Why choose an open source alternative?

  • •Data ownership: Keep your data on your own servers
  • •No vendor lock-in: Freedom to switch or modify at any time
  • •Cost savings: Reduce or eliminate subscription fees
  • •Transparency: Audit the code and know exactly what's running