Clockwork
TOTP codes without a network permission. Offline by design, nothing stored.
Version: 1.5.2
Added: 12-08-2026
Updated: 12-08-2026
Added: 12-08-2026
Updated: 12-08-2026
Clockwork generates two-factor codes (TOTP, RFC 6238) entirely on your device. The Android app declares no INTERNET permission — it cannot go online, and you can check that claim yourself in the manifest.
The app is the project's single-file web build carried by a system WebView: the same clockwork.html you can download from a release and open on any computer.
What it does:
* Generates TOTP codes — SHA-1, SHA-256 or SHA-512, 6 to 8 digits, any period. The countdown is a 30-mark dial with a rotating hand, not a progress ring.
* Takes input in every shape you are likely to have it: raw Base32, otpauth:// URIs, a whole Google Authenticator export, or a QR code from the camera or an image.
* Explains broken lines instead of failing silently.
* Optionally remembers your secrets behind a passphrase — strictly opt-in, AES-256-GCM over PBKDF2-SHA-256 with 600,000 iterations, with an auto-lock. Without the vault, nothing is stored at all.
* Speaks 37 languages, all bundled, including right-to-left layouts.
The camera permission exists solely for the QR scanner and is declared optional hardware; importing a QR code from an image works without it. Auto-backup is disabled, so the encrypted vault never leaves the device.
The OTP algorithms are implemented from scratch against the RFC test vectors — no OTP library. The only borrowed crypto primitive is the Web Crypto API.
Important, independent of this app: set up backup codes with every provider before relying on any authenticator. They are the only thing that gets you back in when the secret is gone.
The app is the project's single-file web build carried by a system WebView: the same clockwork.html you can download from a release and open on any computer.
What it does:
* Generates TOTP codes — SHA-1, SHA-256 or SHA-512, 6 to 8 digits, any period. The countdown is a 30-mark dial with a rotating hand, not a progress ring.
* Takes input in every shape you are likely to have it: raw Base32, otpauth:// URIs, a whole Google Authenticator export, or a QR code from the camera or an image.
* Explains broken lines instead of failing silently.
* Optionally remembers your secrets behind a passphrase — strictly opt-in, AES-256-GCM over PBKDF2-SHA-256 with 600,000 iterations, with an auto-lock. Without the vault, nothing is stored at all.
* Speaks 37 languages, all bundled, including right-to-left layouts.
The camera permission exists solely for the QR scanner and is declared optional hardware; importing a QR code from an image works without it. Auto-backup is disabled, so the encrypted vault never leaves the device.
The OTP algorithms are implemented from scratch against the RFC test vectors — no OTP library. The only borrowed crypto primitive is the Web Crypto API.
Important, independent of this app: set up backup codes with every provider before relying on any authenticator. They are the only thing that gets you back in when the secret is gone.