Possibly the first open-source authenticator built around 3 trust boundaries instead of 1

We’re a small team building an iPhone TOTP authenticator called LocalAuth, and I’m the primary developer behind it.

The project started as a small internal experiment, but it kept growing because we felt the same tradeoff kept showing up in most authenticator apps:

either everything lives behind the same software boundary,

or the “secure” answer becomes so hardware-heavy that everyday use gets annoying.

What we wanted was something more tiered.

So LocalAuth is built around 3 different trust boundaries:

- Face ID / Secure Enclave for low-friction everyday accounts

- a dedicated YubiKey channel for more sensitive accounts

- a generic FIDO hmac-secret channel for compatible security keys when stronger separation makes sense

The core idea is simple:

not every TOTP account deserves the same protection model.

A few other design choices mattered a lot to us:

- local-first by default; tokens stay on-device

- nearby encrypted transfer for device migration

- an optional self-hostable Travel Vault for temporary off-device backup / restore

- Travel Vault is end-to-end encrypted: the payload is encrypted locally first, and the server only sees encrypted data plus locator / wrapped-key material

- the project is open source, including the less glamorous parts like implementation notes and deployment details

This isn’t meant as a “passkeys replacement.”

It’s more a response to the fact that many of us still have to live with TOTP, and most existing apps flatten everything into one trust boundary.

We built this because we wanted an authenticator that treats low-value and high-value accounts differently, instead of putting every code in the same basket.

Curious whether this model resonates with anyone else here, especially people who care about local-first tools, hardware keys, or self-hosted recovery paths.

The App link:
https://apps.apple.com/us/app/localauth/id6760096502
The open source Github link:
https://github.com/LocalLens-Project/localauth-ios