BeardPowered — Sovereign 2FA

Your 2FA codes are on
Google's your server.

Every time you scan a QR code into Google Authenticator, the seed secret that generates your codes gets backed up to Google's servers. It doesn't have to work that way.

BeardAuth is a self-hosted TOTP authenticator. Same 6-digit codes. Same QR code standard. Works with every site that supports 2FA. The difference is where the secrets live.

Request access How it works ↓
Where your 2FA seed secrets live right now
JBSWY3DPEHPK3PXP
Google's servers
Where they'd live with BeardAuth
JBSWY3DPEHPK3PXP
your VPS
The problem with trusting them

These apps hold the master keys to your accounts. Here's their track record.

2FA is supposed to protect you. But when your authenticator app is a black box run by a corporation, you've just moved the single point of failure somewhere you have no control over.

Authy
Breached in 2024. 33 million phone numbers exposed.
Twilio confirmed attackers accessed Authy's database and scraped 33 million registered phone numbers. Multi-device sync means your secrets aren't just on your phone.
data breach 2024
Google Authenticator
Cloud sync enabled by default. Seeds go to Google.
Since 2023, Google Authenticator syncs your 2FA seeds to your Google account by default. The app that was supposed to be a second factor now has a single corporate point of failure.
design decision 2023
Microsoft Authenticator
Backup and restore runs through Microsoft's cloud.
Recovery requires your Microsoft account. If your account gets compromised or locked, your recovery path runs through the same corporation whose servers hold your backup.
vendor lock-in
All of them
Closed source. You can't verify what they actually do.
None of the major authenticator apps are fully open source. You're trusting their privacy policy, not their code. You have no way to verify what telemetry leaves your device.
unverifiable
The difference
Google / Authy / Microsoft
Their server. Their terms. Their breach.
✗
Seeds backed up to corporate cloud — often by default
✗
Closed source — no way to verify what leaves your device
✗
Recovery depends on your account with them — one more attack surface
✗
Lock-in — switching means re-scanning every QR code manually
✗
Their breach is your problem
BeardAuth
Your server. Your secrets. Full stop.
✓
Seeds stored encrypted on your VPS — nowhere else
✓
Standard TOTP — works with every site Google Authenticator works with
✓
You control backup and recovery — no corporate dependency
✓
Export your seeds anytime — no lock-in
✓
Your server gets breached only if you let it
How it works
BeardAuth — your codes ● your-server.com
GitHub
github.com
482 917
Cloudflare
cloudflare.com
731 044
AWS Console
aws.amazon.com
209 563
⚡ Codes generated on your server — seeds never leave
01
Deploy BeardAuth to your server
One deployment. Runs on any VPS. Accessible from your phone's browser — no app store required. Your server, your domain, SSL included.
→ Deployed via App Factory in under 2 minutes
02
Scan the same QR codes you always have
BeardAuth uses the standard TOTP protocol — the same one Google Authenticator, Authy, and every major site uses. Scan any QR code from any site that supports 2FA. Nothing changes on their end.
03
Your seeds are encrypted on your server
The seed secret that generates your 6-digit codes is stored encrypted in your database on your VPS. It never gets sent to a third party. Never backed up to a corporate cloud. Never at risk in someone else's breach.
04
You control backup and recovery
Export your seeds anytime in standard format. Back them up however you want — encrypted file, second VPS, air-gapped drive. Your recovery plan doesn't depend on a corporation staying in business or keeping your account active.

Ready to stop trusting them with your keys?

BeardAuth is deployed as part of the BeardPowered sovereign stack. Get in touch to get it set up on your infrastructure.

Email us michael@beard.energy
Part of the BeardPowered suite — sovereign software for contractors who own their stack.