Clockwork

about

description

Clockwork is a two-factor authenticator (2FA) that generates TOTP codes entirely on your device. It declares no INTERNET permission at all — the app cannot open a connection, and you can check that in the manifest before you believe a word of this. That is the difference. Most authenticator apps hold network access for sync, service icons or update checks. Clockwork does not have the permission, so the question never comes up. WHAT IT DOES • Generates TOTP codes (RFC 6238) — SHA-1, SHA-256 or SHA-512, 6 to 8 digits, any period. • Add accounts the way you happen to have them: scan a QR code, import a QR image, paste an otpauth:// link, or type a Base32 secret. A full Google Authenticator export is converted automatically. • A dial with 30 marks and a moving hand shows the time left — a position you read at a glance, not a shrinking bar. • One tap copies the code, and the next one is on screen before it becomes valid. • Broken input is explained line by line, never silently swallowed. YOUR SECRETS STAY YOURS • By default nothing is stored at all. Close the app and the secrets are gone. • Switch the vault on and they stay here, encrypted with your passphrase: AES-256-GCM, key derived by PBKDF2-SHA-256 with 600,000 iterations. Only the sealed envelope is written to disk — never the plaintext, never the passphrase, never the derived key. • Unlock with your fingerprint if you want to. The passphrase stays the only way back in. • Locks automatically after a time you choose and when you leave the app. Screenshots and preview images can be blocked. • Android backup is switched off, so the encrypted vault never leaves the device. PRIVACY Nothing is collected, because there is nowhere for it to go. No analytics, no telemetry, no update pings, no advertising identifiers, no accounts, no ads. The camera permission serves the QR scanner alone and is declared optional hardware — importing a QR image works without it. BUILT TO BE CHECKED Open source under the MIT licence. The OTP algorithms are written from scratch against the RFC test vectors — no OTP library. Source code, test suite and the measurement scripts behind every claim above are public at github.com/keco216/clockwork. Speaks 37 languages, all bundled, including right-to-left layouts. Android 8.0 or newer. On Android 7, 1.5.4 stays the final version. One thing, independent of this app: set up backup codes with every provider before you rely on any authenticator. They are the only thing that gets you back in when a secret is gone.

publisher

78ce6faa72264387284e647ba6938995735ec8c7d5c5a65737e55130f026307d

first seen

2026-10-08T15:57:10.136683+00:00

last event

2026-10-08 15:57 UTC

install

zapstore.dev or any Zapstore-compatible client

source & build

repository

https://github.com/keco216/clockwork

arch flags

android-arm64-v8a android-armeabi-v7a android-x86 android-x86_64

manifest

missing

releases (kind 30063)

1 release indexed; latest 2.0.1.

assets & verification

Every app, release and asset event is schnorr-verified (NIP-01 id + signature) before it enters the catalog, and assets are content-addressed by sha256. We subscribe read-only to the catalog relay — never write to it.

2.0.1 — io.github.keco216.clockwork_20001.apk

sha256

4bb833f06a478c535cfc2a13c9a85db687fc2fa26dcc751028d8e9fcf1fefe98

size

3.2 MB

archs

android-arm64-v8a, android-armeabi-v7a, android-x86, android-x86_64

version code

20001

apk cert sha256

ddb51f95e8b0187e5d2168ec99f1448f4ce7db373ac3a0ad43e62323c8bd2a47

download

io.github.keco216.clockwork_20001.apk

Showing the newest 1 asset descriptor; the full set is in /api/apps/78ce6faa…