Ghost Auth review
A privacy-focused authenticator with encrypted storage, backups, sync, and broad imports.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Ghost Auth is an open-source authenticator for generating TOTP codes across mobile devices, desktop operating systems, and browser extensions. It suits users who want a privacy-focused alternative with no account requirement, cloud storage, analytics, or advertising. Setup supports QR-code scanning and manual otpauth:// entry, while TOTP compatibility includes RFC 6238 and SHA-1, SHA-256, and SHA-512. The product is developed by Kestrel AS and is distributed under the GPL v3 license.
The published Free plan costs $0 and includes the GPL v3 license, TOTP code generation, and encrypted local storage. Its platform coverage includes Windows, macOS, Linux, iOS, Android, Chrome, Firefox, and Edge. Ghost Auth also supports imports from Google Authenticator, Aegis, 2FAS, andOTP, FreeOTP+, Ente Auth, Bitwarden, and Proton. The official homepage currently labels desktop downloads as coming soon, while the stated platform support includes desktop systems and browser extensions.
Security and recovery features are central to the product. Local data uses AES-256-GCM encryption, accounts can be protected with a PIN and recovery codes, and escalating rate limits are included. Password-protected encrypted backup and restore add a portable recovery path. Device-to-device synchronization is end-to-end encrypted over a local network, browser extensions can synchronize, and Apple devices can use an encrypted iCloud vault. Ghost Auth is a strong fit for open-source users who prioritize encrypted storage and wide platform support; users seeking a broader password manager or immediately available desktop downloads may prefer another option.
Ghost Auth pros and cons
- Where it wins
- GPL v3 open-source TOTP authenticator with encrypted local storage
- Supports Windows, macOS, Linux, iOS, Android, and browser extensions
- Encrypted backups, local-network sync, iCloud sync, and broad imports
- Where it doesn't
- Official homepage currently labels desktop downloads as coming soon
- Local-network synchronization is limited to device-to-device syncing
- Biometric unlocking is available only on supported mobile devices
Ghost Auth fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update