smart-2fa-manager-bash ^v1.1.0

Lightweight, offline, independent TOTP 2FA manager for Linux

No cloud, no phone required. Store your secrets locally, generate codes, create encrypted backups, and sync with Google Authenticator via QR codes.

Bash 2FA Security Linux TOTP Offline

GitHub

smart-2fa-manager-bash — lightweight, offline, independent TOTP 2FA manager for Linux in Bash.

No cloud, no phone required. Store your secrets locally, generate codes, create encrypted backups, and sync with Google Authenticator via QR codes.

Lightweight — pure Bash, minimal dependencies
Offline — no internet connection required
Encrypted Storage — AES-256 encrypted with GPG
QR Code Export — scan with Google Authenticator / Aegis
Encrypted Backups — timestamped backups with restore
Clipboard Integration — auto-copy TOTP codes
Simple Commands — intuitive CLI interface

Dependencies:

# Arch Linux
sudo pacman -S oath-toolkit gnupg qrencode

# Debian/Ubuntu
sudo apt install oathtool gpg qrencode

# Fedora/RHEL
sudo dnf install oathtool gnupg2 qrencode

Setup:

# Clone repository
git clone https://github.com/smartlegionlab/smart-2fa-manager-bash.git
cd smart-2fa-manager-bash

# Or download directly
wget https://raw.githubusercontent.com/smartlegionlab/smart-2fa-manager-bash/main/2fa.sh

# Install
chmod +x 2fa.sh
sudo cp 2fa.sh /usr/local/bin/2fa.sh

Important!

The command 2fa.sh init should only be run on first launch! If you already have a .2fa folder created earlier that already stores your services, initialization is not required; you can start using the application immediately.

# Initialize storage (creates encrypted ~/.2fa/secrets.gpg)
2fa.sh init

Command	Description
`init`	Create encrypted storage
`add <service> <secret>`	Add a new service
`get <service>`	Generate TOTP code (copies to clipboard)
`list`	List all service names
`show-all`	List all services with current codes
`del <service>`	Delete a service
`show`	Show all secrets in plain text (⚠️ unsafe)
`qr <service>`	Show QR code to scan with phone
`backup`	Create encrypted backup with timestamp
`restore <file>`	Restore from encrypted backup
`about`	Show author, repository and license info
`version`	Show version number
`help`	Show help message

Basic Usage:

# Important! This command should only be run on first launch!!!
# Run only if you don't have a ~/.2fa folder
2fa.sh init

# Add a service (secret from website QR code)
2fa.sh add github JBSWY3DPEHPK3PXP

# Get TOTP code (auto-copies to clipboard)
2fa.sh get github

# Show all services with current codes
2fa.sh show-all

# Export QR code to phone (Google Authenticator / Aegis)
2fa.sh qr github

# Create encrypted backup (saved to ~/.2fa/backups/)
2fa.sh backup

# Restore from backup
2fa.sh restore ~/.2fa/backups/secrets.2026-04-06.gpg

# Show version
2fa.sh version

# Show author and repository info
2fa.sh about

~/.2fa/
├── secrets.gpg          # Encrypted master storage
└── backups/
    └── secrets.2026-04-06_14-30-00.gpg

Secrets are stored locally in ~/.2fa/secrets.gpg (AES-256 encrypted with GPG)
No internet connection required — codes generated locally using oathtool
Backups are encrypted with the same password
QR codes let you import secrets into Google Authenticator / Aegis
Lost your phone? Just re-scan QR codes from your Linux machine

Your GPG password is never stored
Backup files are encrypted with the same password
2fa.sh show displays all secrets in plain text — use in secure environment only
Keep backups in a safe place (encrypted USB drive, offline storage)