// offline_2fa + code_workshop · v1.0_2026.07
One workshop.
One vault.
Zero exfiltration.
$ decode --offline --no-cloud --no-tracking
TOTP/HOTP vault, universal decoder and code workshop in one app. No cloud, no account, no tracking — the release build doesn’t even hold the INTERNET permission.
// 01_authenticator
The Vault
Your 2FA vault. Scan Google Authenticator exports, import accounts, generate live codes. Export individually or as batch — compatible with any standard authenticator.
- TOTP & HOTP, SHA-1/256/512/MD5, 6/8 digits
- Google Authenticator migration QR (batch)
- Drag-to-reorder, edit, double-confirm delete
- Single & batch export as otpauth:// / migration QR
- Live countdown, turns red at ≤ 5 s
// 02_decoder
The Decoder
Point your camera at any code. D.Code breaks its content into structured fields and shows you exactly what’s inside — ranked by confidence.
- 18 symbologies — 13 live, 5 more via gallery (Micro QR, rMQR, MaxiCode, …)
- 43 content detectors with confidence scoring
- Copy individual fields via long-press
- Pinch-to-zoom, zoom slider, gallery import
- Detects: vCard, WiFi, SEPA, JWT, boarding pass, IBAN, BTC, ETH, …
// 43 detectors loaded.
// how_it_works()
> 01_install
Install. PIN. Done.
Download the app, set a 6-digit PIN, optionally enable fingerprint. No account, no email, no phone number.
> 02_scan
Point camera at any code.
QR code, barcode, Data Matrix — any format. The camera detects it automatically.
> 03_decoded
Every field parsed.
All detected data fields listed in a structured view. Copy, analyze, process.
// 40 content types loaded.
// 03_wizard
The Wizard
A guided 4-step flow for any code type. Live validation stops broken codes before they happen — with smart symbology recommendations for every input.
> 01_type
Pick a content type
40 content types — from URL and email to SEPA transfer, Swiss QR-bill, EMV merchant code or otpauth.
> 02_data
Enter the data
Every field is checked live. 26 input checks flag errors and warnings before the code is built.
> 03_symbology
Choose a symbology
The wizard recommends the right symbology — URL → QR code, article number → EAN-13. 17 symbologies to choose from.
> 04_preview
Preview & generate
Live preview with styling. Export, share or save as a template right away.
// Bonus: turn saved 2FA accounts back into a QR code — biometrics-gated.
// 04_styling
Styling
Codes that match your look — not just black on white. Colors, shapes, logo and error correction for every code you generate.
- Foreground & background color for all 17 symbologies
- QR: eye & module shape — square or round
- Embed a logo — Material icon or your own photo
- Error correction L / M / Q / H + adjustable quiet zone
- Auto-contrast warning prevents unscannable color combos
- With a logo, error correction is raised automatically — stays scannable
Branded Templates
Design once, generate forever. Save styling and fixed content as your own template — a branded company QR with logo and colors, reproducible any time.
- Save your own templates, styling included
- Favorites for frequently used content types
- One tap — a finished code in your usual look
// 05_export
Export
Codes for any purpose — from a social post to print. Four formats, plus direct sharing to your operating system.
PNG
Four sizes (S / M / L / XL) — for web, chat and slides.
SVG
Vector-based — scales losslessly for print and large formats.
Optionally with embedded metadata about the code content.
SHARE_SHEET
Straight to WhatsApp, Mail, Drive — the app keeps no cloud of its own.
// otpauth codes (2FA) export as PNG only, for privacy — no plaintext secrets in searchable formats.
// 06_history
History
What you scanned and created — visual, with automatic cleanup. And without leaving your secrets in plaintext.
- Scanned codes with the original image (optional)
- Generated codes with the rendered code image
- Auto-cleanup after a configurable period — 90 days by default
- Sensitive data masked: otpauth secrets, WiFi passwords, URL credentials, PGP keys
// 07_backup
Vault Backup
Device migration without a cloud. D.Code exports your entire vault as a single encrypted file — and imports it on your new device. Your secrets only ever leave the device inside a shell encrypted with your passphrase. Part of D.Code Lifetime.
- AES-256-GCM, key derived from your passphrase (PBKDF2)
- One portable .dcode file — no cloud, no account
- Additive import: merges accounts instead of overwriting
- Doubly gated — entitlement and secret gate (biometrics/PIN)
- The real migration path to a new device — fully offline
// security.architecture
NO_INTERNET_PERMISSION
Release manifest contains no android.permission.INTERNET.
PBKDF2_PIN
PBKDF2-HMAC-SHA256, 100,000 iterations, salted. The PIN is never stored.
BIOMETRIC_GATE
Biometrics with PIN fallback. Every secret access runs through the same central gate.
ESCALATING_LOCKOUT
5/10/15/20+ failed attempts → 30 s / 5 min / 30 min / 1 h lockout.
ANDROID_KEYSTORE / IOS_KEYCHAIN
flutter_secure_storage → hardware-backed Keystore / Keychain.
FLAG_SECURE
Accounts, detail, scanner: no screenshots, no screen recording.
ROUTER_GUARD
Every navigation checks lock state. No screen reachable without unlock.
AUTO_LOCK
Immediately / 30 s / 60 s / 120 s / 5 min.
CLIPBOARD_TIMEOUT
Auto-wipe after 10–120 s.
HISTORY_MASKING
otpauth secrets, WiFi passwords, URL credentials and PGP keys are masked in history.
AUDIT_LOG
Persistent security log — unlocks, reveals, exports, failed attempts. Viewable by you.
NO_TELEMETRY
No analytics SDK. No Sentry. No Firebase.
// diff D.Code vs. cloud-2fa
| Feature | D.Code | Google Auth | Authy | MS Auth |
|---|---|---|---|---|
| Works without internet | ✓ | ✓ | (✗) | (✗) |
| No account / phone number needed | ✓ | ✓ | ✗ | ✗ |
| Cloud-syncs your secrets | ✗ | opt. | forced | forced |
| Universal code scanner | ✓ | ✗ | ✗ | ✗ |
| 43 content detectors | ✓ | ✗ | ✗ | ✗ |
| Code generator + styling + export | ✓ | ✗ | ✗ | ✗ |
| Screenshot protection | ✓ | ✓ | ✗ | ✓ |
| Viewable security log | ✓ | ✗ | ✗ | ✗ |
| No INTERNET permission | ✓ | ✗ | ✗ | ✗ |
// comparison based on public documentation, Nov 2025. trademarks of their respective owners.
// screenshots
// dashboard — Five tiles, zero distraction
// accounts — Live codes with countdown
// account_detail — Secret, QR export, timer
// raw_scan — Camera, zoom, scan frame
// scan_result — Fields parsed, confidence scored
// create_code — 40 content types, wizard with live validation
// history — Every scan saved, swipe to delete
// settings — PIN, biometrics, theme, timeout
// pricing
One price. Forever.
Start free — with a full offline vault and universal scanner. Want the full depth? Pay once: no subscription, no ads, no cloud.
D.Code Free
€0
A full 2FA vault & universal scanner. Free forever.
- Up to 10 TOTP/HOTP accounts
- Universal scanner with everyday detectors
- Code generator with everyday templates
- PIN, biometrics & full device protection
- 100% offline — no ads, no cloud, no tracking
D.Code Lifetime
€5.99 one-time
Everything unlocked. Pay once, yours forever.
- Unlimited accounts & folders
- All 43 detectors & all 40 generator templates
- Export (PNG/SVG/PDF) & encrypted vault backup
- All color themes & multiple “My QR” cards
- Full scan history (200 instead of 20)
// Support an indie instead of selling data. No subscription, no account. Restore on all your devices.
| Feature | Free | Lifetime |
|---|---|---|
| OTP accounts | up to 10 | unlimited |
| Folders | – | ✓ |
| Code detectors (43) | 13 everyday types | all 43 |
| Generator templates (40) | 9 everyday templates | all 40 |
| Color themes | 1 | 4 |
| Export (PNG / SVG / PDF) | – | ✓ |
| Encrypted vault backup | – | ✓ |
| Scan history | last 20 | full 200 |
| Multiple “My QR” cards | 1 | unlimited |
| No ads · no cloud · no tracking | ✓ | ✓ |
| 100% offline · no INTERNET permission | ✓ | ✓ |
// Existing accounts, folders & themes always stay fully usable — only creating new ones past the free limit is gated. Revealing a single secret is always free.
Coming 2026.07
Android & iOS. No early access. No newsletter. No tracking. Just wait.
// Store links go live in July 2026.