Auth Token

Auth Token, from Mark McAvoy, produces OATH software tokens on Android. It fills the role a hardware key fob once did: an account is enrolled once, and the application then generates the short numeric codes a login prompt asks for as a second factor. The token lives in software on the handset instead of on a separate physical device.

OATH covers two families of one-time passcode, counter-based (HOTP) and time-based (TOTP). Applications in this category work with any service that hands out a standard enrolment secret, usually as a QR code or a typed string, rather than requiring a vendor-specific companion app. In practice this means one application can hold tokens for several unrelated accounts.

The listing covers Android only, so the tokens are tied to the device where they are enrolled; there is no desktop counterpart in this entry. The licence is GPL-3.0-only, a stricter choice than the "or-later" variant, since redistribution must stay under version 3 of the GPL specifically.