How MELKEM Authenticator works

Codes

MELKEM Authenticator makes standard TOTP codes. It supports SHA-1, SHA-256 or SHA-512, 6 or 8 digits, and 30 or 60 seconds. HOTP and Steam codes aren’t supported.

Setup keys

Each setup key is stored in the iPhone’s Keychain as “this device only” and isn’t synced to iCloud Keychain. It doesn’t move to another iPhone through a backup or restore. The only way it leaves the phone is an encrypted export that you create.

Encrypted export

An encrypted export uses AES-256-GCM. The key is derived from your passphrase with PBKDF2-HMAC-SHA256 at 1,000,000 iterations, with a new random salt for every export.

Without the passphrase, the file can’t be opened, and MELKEM can’t recover it.

Lock

The lock is always on, with Face ID, Touch ID or the device passcode. A device passcode is required to show codes. Auto-lock can be set to immediately, after 1 minute or after 5 minutes.

Network

The app uses only Apple’s system frameworks, and none of the networking ones. Every build runs a check that fails if networking APIs appear.

You can check the network part yourself. Our guide shows how to see which apps on your iPhone use the internet.

Requirements

An iPhone with iOS 17 or later.

What it doesn’t do

It doesn’t sync between devices.
It is for iPhone only.
It isn’t open source.
It has had no independent security audit.

More

MELKEM Authenticator, support and the privacy policy.