Notes 
Yubico Authenticator generates TOTP codes from secrets stored in a YubiKey’s secure element, not on the phone or computer. Each code generation requires the physical key to be present, making credential theft from a compromised device nearly impossible. The app itself is open-source under GPLv3 and works on Windows, macOS, Linux, and Android.
Reviewed by Marco Wollank
Yubico Authenticator
yubico.com/products/yubico-authenticator No ratings yet. Be the first.
Rate Yubico Authenticator: No account needed
Threat level
Hardened
A hardened pick. Worth the effort once you have chosen to shrink your footprint on purpose. Enough for most people. Threat levels
Our take
Moving TOTP secrets off the device and into hardware is a meaningful security upgrade over any phone-based authenticator. If your phone is stolen or your computer is compromised, an attacker still cannot generate codes without the physical YubiKey. The catch is the dependency: you must own a compatible YubiKey, and losing the key without a backup means losing access to all accounts stored on it. That makes backup discipline non-negotiable. For users who already carry a YubiKey for passkeys or SSH, this is the obvious companion app; for everyone else, the hardware cost and backup requirement raise the bar compared to apps like Aegis.
GitHub at a glance
Yubico/yubioath-flutter Apache-2.0 fidoflutteroathtotpyubikey
Stars
1,404
+7 this week
Forks
184
66 watching
Last commit
today
healthy
Latest release
7.5.0
today, 56 total
Star history
Issues
89% closed
75
open
593
closed
+1 / -0
opened / closed, last 4 weeks
Opened vs closed, last 12 weeks
Commits, last 26 weeks
65 commits, active 11 of 26 weeks
18 contributors since Feb 2014
Languages
- Dart 63.1%
- Kotlin 27.3%
- Python 6.6%
- Other 3%
Updated daily from the GitHub API. Star tracking since Jun 22, 2026.
Website at a glance
yubico.com
B score 75
Solid website security headers
Graded by Mozilla HTTP Observatory, tested 3d ago
Inspect this site yourself
Measures the security configuration of the tool's own website, not the privacy of the product itself. A strong tool can still score low here.
Yubico Authenticator alternatives
ente Authenticator Features: End-to-end encrypted cloud backups and multi device synchronization. Offline mode and import & export tokens. It's the only open-source solution that is available for…
Aegis Authenticator Aegis Authenticator: Encryption, Organization and Backups for Android
2FAS Features: Device synchronization, modern user-interface and backups. The main advantages are the browser extensions that enable one-tap authentication and no need to switch…
Tofu Tofu: Easy-to-use and designed specifically for iOS
Raivo OTP Unlisted for now because Raivo was sold, and the new owner wasn't able to clarify concerns listed in the GitHub discussion. The warning will be removed once the situation is…
Yubico Authenticator license, in plain English
Apache-2.0 Permissive
Permissive like MIT, with an explicit patent grant and a requirement to flag any changes you make.
Permits
- Commercial use
- Modification
- Distribution
- Patent use
- Private use
Requires
- License and copyright notice
- State changes
Does not provide
- Trademark use
- Liability cover
- Warranty
Why it matters: Permissive licensing lets anyone reuse this, including inside closed products. That is freedom to build on, but no guarantee that downstream copies stay open.
Plain-language summary of the project's license, not legal advice. Read the full text for the exact terms.
* Average ratings will show on this page once the threshold of 5 ratings is reached.