FreeOTP review: sign-in codes on your phone

FreeOTP is a free open-source authenticator: an app that creates the short sign-in codes a website asks for after your password.⁶ It is for people who want that second check on their own phone, with the secret kept on the device. Open standards mean one app can serve many sites, with no private FreeOTP server required.¹

Last checked October 28, 2026.

At a glance

What it is: A free open-source authenticator that makes standard HOTP and TOTP sign-in codes on your phone.¹⁶

Works on: Android 6.0 or newer; iPhone, iPad, and iPod touch with iOS or iPadOS 11 or later.⁵⁷

Price: Free. The App Store lists it as free, and the listings call it free software.⁶⁷

Licence: Apache License 2.0.²⁵

Best for: People who want sign-in codes kept on the device, using open standards.

Official site: freeotp.github.io

What FreeOTP does (and how it protects your privacy)

A one-time password is a short code that changes, so a leaked password is only half of a login. FreeOTP creates those codes for two open standards: HOTP, which counts each use, and TOTP, which changes with the clock. The Android project names them as RFC 4226 and RFC 6238.² You add an account by scanning a QR code, the square barcode a site shows during setup.¹ The official site says no proprietary server-side component is necessary, so any service that speaks those standards can work, including FreeIPA. Google Play says it may also work for company security that uses TOTP or HOTP.¹⁶

The phone works out the code itself. Both stores say the passwords can be generated in airplane mode.⁶⁷ On Android, version 2.0 and later puts token secrets in the Android Keystore, the phone’s store for cryptographic keys. The project calls that a one-way move that makes the secrets impossible to extract, by design.³ On iPhone and iPad, secrets go in the Apple Keychain and, except for locked tokens, move to a new device with an encrypted backup.⁴

You still want a strong password beside the code. Keep it in a different app, such as KeePassDX if you want an Android vault in a file you control. A second code also limits the damage when a password from an old breach is reused. BellCrier checks your email addresses against known data breaches and emails you when one turns up, with what was exposed and how to fix it.

Key features of the FreeOTP authenticator

Open standards. HOTP and TOTP, and no private server component is required.¹²
QR codes and typed setup. F-Droid describes manual entry on Android. The App Store history for iOS 2.3.2 lists a manual add screen.⁵⁷
Offline codes. Both stores say passwords can be generated in airplane mode.⁶⁷
Android master password. It is kept in the Android Keystore and encrypts the token data, either in a Google account backup or a file you save.³
iOS Keychain. Restore uses an encrypted Apple backup. Locked tokens are left out of device backups.⁴
Face ID on iOS. Version 2.1’s App Store notes list Face ID biometric unlock.⁷
7-digit and 9-digit codes. Version 2.2’s App Store notes list support for both.⁷
Sort by recent use. The February 2026 Play notes include “Sort by Recently Used” and dark-mode improvements.⁶

Pros and cons of FreeOTP

Pros

Free software, with public source and an Apache 2.0 licence.²⁴⁶
Official downloads are F-Droid, Google Play, and the App Store.²⁴
Red Hat is named on both stores, and both privacy labels say no data is collected.⁶⁷
F-Droid builds and signs its package, and says that build corresponds to the source tarball.⁵

Cons

F-Droid warns that users have reported backup and restore problems, and asks you to test a restore on a new device.⁵
Android’s move into the keystore is one-way.³ A lost master password, or a failed restore, means using each website’s own recovery steps.
Locked tokens on iOS are excluded from device backups. The project says Apple enforces that.⁴
The Android and iOS download sections list the phone apps. They do not list a desktop build.²⁴
The App Store listing is in English.⁷

Is FreeOTP safe and private?

Red Hat publishes the store apps. Google Play names the developer as Red Hat, and the developer details name Red Hat, LLC. The App Store seller is Red Hat, Inc.⁶⁷ Both source repositories are public, and both READMEs welcome contributions under the Apache 2.0 licence.²⁴

Google Play’s data-safety section is filled in by the developer. It says no data is collected and no data is shared with third parties.⁶ Apple’s listing says the developer does not collect any data from this app.⁷ Those lines are the developer’s statements to the stores.

The Android README lists two permissions. Camera access is for QR codes. Internet access is for token images, and the project marks both as not required.² F-Droid’s page for version 2.0.6 also shows approximate location in the foreground, Bluetooth pairing, fingerprint hardware, and vibration. The README table does not describe those extra items.²⁵

An Android backup is an XML file, encrypted with a master key in the Android Keystore. Restore always asks for the master password. You can use Android’s automatic backup to a Google account, or save a file from the toolbar items labelled Backup and Restore.³ On iOS, restore needs an encrypted backup. Locked tokens are left out. The project says Apple does this so biometric data such as Face ID stays on the device.⁴

F-Droid lists version 2.0.6 (48), added on 19 February 2026, for Android 6.0 or newer, and says that build corresponds to this source tarball.⁵ Google Play shows an update on 17 February 2026.⁶ The App Store version is 2.3.6, dated 19 November 2025, for iOS 11.0 or later.⁷

How to get started with FreeOTP

Install FreeOTP from F-Droid or Google Play, or from the App Store. Those are the links in the project READMEs.²⁴
On the account you want to protect, turn on two-factor authentication and choose an authenticator app. Sites often label this TOTP.
In FreeOTP, scan the QR code. On Android you can type the token configuration. On iOS, version 2.3.2’s notes list a manual add screen.⁵⁷
On Android, set the master password when asked. It is stored in the Android Keystore and used to encrypt the token data. Restore always asks for it.³
Type the code from FreeOTP into the website, and wait until the site confirms the new sign-in method.
Save the recovery codes the website shows, somewhere other than that phone.
On Android, choose Backup and keep the encrypted file.³ On iPhone, turn on encrypted backups.⁴ Test an Android restore while you still have the old phone, as F-Droid asks.⁵

Who should use FreeOTP (and who might prefer something else)

FreeOTP suits someone who wants sign-in codes on Android or iPhone, stored on the device, with a backup they will test. Workplace accounts that use TOTP or HOTP, including FreeIPA, match what the project describes.¹⁶

To compare other open-source code apps, see 2FAS Auth and Proton Authenticator. The Android and iOS pages list mobile apps, so a desktop is outside those downloads.²⁴ If moving phones matters most, read F-Droid’s backup note first.⁵

Frequently asked questions

Is FreeOTP free?

Yes. The App Store lists it as free.⁷ Google Play calls it open source and free software under the Apache 2.0 licence, and F-Droid lists that licence too.⁵⁶

Is FreeOTP safe?

Secrets sit in the Android Keystore or the Apple Keychain, and both stores say the developer collects no data.³⁴⁶⁷ Keep each site’s recovery codes: F-Droid says users have reported restore problems.⁵

Does FreeOTP work on iPhone?

Yes. It is on the App Store for iPhone, iPad, and iPod touch. Version 2.3.6 is dated 19 November 2025 and needs iOS 11.0 or later, or iPadOS 11.0 or later on iPad.⁷

Does FreeOTP work offline?

The codes do. Both stores say they can be generated in airplane mode.⁶⁷ On Android, internet access is optional and is used to fetch a token image.²