Notes 
Tofu: Easy-to-use and designed specifically for iOS
Reviewed by Marcus Holmberg
Tofu
tofuauth.com No ratings yet. Be the first.
Rate Tofu: No account needed
Threat level
Covered
A covered pick. Anyone can use it as a private drop-in, with no setup or know-how. Enough for most people. Threat levels
Our take
Tofu is a deliberately small, easy iOS-only authenticator for people who want a clean app and nothing more. Its simplicity is the appeal and the limitation in one: no cross-platform support, and development is quiet, so do not expect a steady stream of new features. It is a fine pick for an iPhone user who values an uncluttered, no-frills app, but anyone wanting encrypted cross-device backup should look to Ente instead.
GitHub at a glance
iKenndac/Tofu ISC
Stars
538
+0 this week
Forks
68
12 watching
Last commit
2.4y ago
slowing
Star history
Issues
56% closed
37
open
47
closed
+0 / -0
opened / closed, last 4 weeks
Opened vs closed, last 12 weeks
Commits, last 26 weeks
0 commits, active 0 of 26 weeks
17 contributors since Mar 2016
Languages
- Swift 98.7%
- Shell 1.3%
Updated daily from the GitHub API. Star tracking since Jun 15, 2026.
Website at a glance
tofuauth.com
D- score 25
Weak website security headers
Graded by Mozilla HTTP Observatory, tested 4d ago
Inspect this site yourself
Measures the security configuration of the tool's own website, not the privacy of the product itself. A strong tool can still score low here.
Tofu alternatives
ente Authenticator Features: End-to-end encrypted cloud backups and multi device synchronization. Offline mode and import & export tokens. It's the only open-source solution that is available for…
Aegis Authenticator Aegis Authenticator: Encryption, Organization and Backups for Android
2FAS Features: Device synchronization, modern user-interface and backups. The main advantages are the browser extensions that enable one-tap authentication and no need to switch…
Raivo OTP Unlisted for now because Raivo was sold, and the new owner wasn't able to clarify concerns listed in the GitHub discussion. The warning will be removed once the situation is…
Yubico Authenticator A TOTP authenticator app that stores one-time password secrets on a YubiKey hardware key rather than on the device, available on Windows, Mac, Linux, and Android.
Tofu license, in plain English
ISC Permissive
A permissive license that is functionally identical to MIT, just with shorter wording.
Permits
- Commercial use
- Modification
- Distribution
- Private use
Requires
- License and copyright notice
Does not provide
- Liability cover
- Warranty
Why it matters: Permissive licensing lets anyone reuse this, including inside closed products. That is freedom to build on, but no guarantee that downstream copies stay open.
Plain-language summary of the project's license, not legal advice. Read the full text for the exact terms.
* Average ratings will show on this page once the threshold of 5 ratings is reached.