Introducing JUK Authenticator: your 2FA codes, secure and offline
A 100% offline two-factor authenticator with PIN, biometrics, recovery codes and over 160 recognized services. Now available for Android.
· Josué Juca
- JUK Authenticator generates the two-step verification (2FA) codes for your accounts right on your phone, with no internet and no sign-up.
- Keys live in the Android vault, protected by PIN and biometrics, with recovery codes in case you forget your PIN.
- It is on Google Play, Android only for now. It is free, with no ads and no in-app purchases.
Most account takeovers start the same way: a password that was leaked, reused or stolen by phishing. According to Javelin Strategy & Research, more than 6 million people had accounts taken over in the United States in 2025, with losses above US$15 billion. In an analysis of about 6,000 attacks, Okta found a compromised password in 87% of takeovers.
The good news is that the most effective defense is also one of the simplest. Microsoft says multi-factor authentication blocks over 99.9% of account compromise attacks. Even so, it is still rarely used: in 2025, according to Sift, 2FA usage across websites and apps stayed between 2.9% and 3.8%.
- people had accounts taken over in the US in 2025 (Javelin)
- 6 million
- of takeovers analyzed by Okta used a compromised password
- 87%
- of account attacks are blocked by 2FA, according to Microsoft
- 99.9%
We built JUK Authenticator to make that step simple and trustworthy. Many authenticators ask for an account, sync to the cloud or show ads. Ours takes the opposite path: your codes stay with you only.
What it delivers
- Offline and private: the app makes no network connections at all. No sign-up, no ads, no analytics, no trackers.
- Secure: each key lives in the device vault (Android Keystore), locked by PIN and biometrics.
- Recovery: forgot your PIN? Use one of the recovery codes generated at setup.
- Easy to add: scan the QR code, type the key or import all your Google Authenticator accounts at once.
- Recognizes the service: automatic icon and name for over 160 services.
- Export whenever you want: a QR code per account or in bulk, to switch phones without relying on the cloud.
- Your way: light or dark mode, 7 theme colors and alternative app icons.
How it works day to day
The home screen shows the account code front and center, large and easy to read, with its countdown. All your accounts sit right below. One tap copies the code, and it is cleared from the clipboard after 30 seconds.
All accounts in one place, the large code with countdown and adding an account with automatic service recognition. The app is shown in Portuguese.To add an account:
- On the service's website (Google, GitHub, Microsoft, your bank), turn on two-step verification and choose the authenticator app option.
- In JUK Authenticator, tap add and scan the QR code on the screen.
- Type the 6-digit code the app shows into the website to confirm.
If you cannot scan, type the secret key: the app recognizes the service and suggests the icon. It also accepts otpauth:// links and Google Authenticator migration codes. For special cases, the advanced options let you choose the algorithm (SHA-1, SHA-256 or SHA-512) and the number of digits.
Layered security
An authenticator holds the keys to your most important accounts, so security cannot be an afterthought. Before launch, we ran a full audit of the code and fixed everything we found.
PIN lock and protected export, with the app's main security layers.| Protection | How it works |
|---|
| Device vault | Each key lives in the Keystore, excluded from backups and tied to this device |
| PIN and biometrics | 4 or 6 digit PIN or biometrics, with a growing wait after 5 wrong attempts |
| Recovery codes | 8 single-use codes, shown once; only their hash is stored |
| No network | Not a single request, not even to set the clock |
| Screen protection | Screenshots blocked and content hidden in the recent apps list |
| Clipboard | Copied codes are cleared after 30 seconds |
| Validated input | Malicious QR codes and links are rejected before they reach the app |
Codes follow the TOTP standard (RFC 6238), used by practically every service that offers an authenticator app, and were validated against the specification's official test vectors.
Because the app does not use the internet, codes depend on your phone's clock. Keep date and time on automatic in Android so your codes are always right.
What 2FA does not solve on its own
Being transparent is part of security. A 6-digit code protects against leaked passwords and automated attacks, but it can be stolen by phishing: in the same Okta analysis, app codes were stolen in 36% of takeovers, usually on fake sites that ask for the password and the code at the same time.
So a few precautions still apply:
- Check the website address before typing your password and code.
- Never share a code by phone, email or message. No legitimate service asks for it.
- For the most critical accounts, such as your main email and your company dashboard, also consider passkeys or hardware keys, which resist phishing.
- Prefer an authenticator app over SMS, which can be hijacked with a SIM swap.
Switching phones without losing your accounts
Since nothing goes to the cloud, you handle the move yourself: in Export codes, pick the accounts and the app shows one QR code per account or a single QR code with all of them. On the new phone, just scan it.
Exporting requires your PIN or biometrics and shows a warning: anyone with that QR code has access to your accounts. Do the move with both phones in hand and do not keep screenshots of the QR code.
Your way
The look adapts to you: light or dark theme, 7 accent colors and alternative home screen icons.
Seven accent colors, light or dark theme and alternative app icons.Available for Android
In this first version, JUK Authenticator is available for Android only, on Google Play. An iOS version is in our plans.
The app is free, with no ads and no in-app purchases. The only permissions it asks for are the camera (to read QR codes), biometrics and vibration.
Get started
- Install JUK Authenticator from Google Play.
- Create a PIN and keep the recovery codes somewhere safe, off your phone.
- Turn on two-step verification for your most important accounts, starting with email, which is the key to recovering all the others.
- If you already use Google Authenticator, export your accounts there and import them all at once.
If your company wants to roll out two-step verification for the whole team, our security team can help you plan and deploy it.
Sources