Support

Choose Add, then scan the QR code the service shows you when enabling two-factor authentication. If you already have a setup link (otpauth://…), paste it in instead — or choose a screenshot of the QR code from your photo library. The account name is optional.

Most services give you a code that changes every 30 seconds. A few hand you a counter-based one instead, which stays the same until it is spent. Autheris works out which kind it is from the QR code or setup link and adds it as the right one, with a Next Code button on its card.

iOS 26.0 or later on iPhone, iPadOS 26.0 or later on iPad, and macOS 14.0 or later on the Mac. Face ID or Touch ID requires the matching hardware; everything else works without it.

The Apple Watch app needs watchOS 26.0 or later and a paired iPhone running the Autheris app. One App Store listing installs the iPhone, iPad and Mac app; the watch app installs from the Watch app on your iPhone, and it shares the codes your iPhone already has — see Autheris on Apple Watch below.

Yes — codes are generated entirely on device. The network is only used when you enable iCloud Sync or when the app looks up an issuer’s logo.

Install the iPhone app first, then open the Watch app on your iPhone and install Autheris from Available Apps — or install it from the App Store on the watch itself. Alternatively, if Automatic App Install is on, it arrives on its own once the iPhone app is installed.

Installing the watch app is what turns the hand-off on: your iPhone starts sending the list to the watch, and the codes are cached there. There is no “send codes to my watch” switch to find — until the watch app is installed, no secret leaves the iPhone, and deleting the watch app stops it again.

The watch shows the last list your iPhone sent, so this is usually one of three things: the iPhone app has no codes yet (add one there), the two devices have not reached each other yet (keep them unlocked and near each other for a moment), or the watch app was just reinstalled and is waiting for the next hand-off. Once the list arrives it stays on the watch and keeps counting down on its own.

That is deliberate. The watch app is read-only — there is no copy, no editing and no settings on the watch — so there is exactly one place your vault is edited: your iPhone. Add, change or delete a code there and the watch follows within seconds.

Yes. The watch generates the codes itself and keeps the last list it received, so they keep counting down with your iPhone in another room, out of battery or switched off.

Not directly — the watch is fed by the iPhone it is paired with, over Apple’s Watch Connectivity, rather than by iCloud. If you use iCloud Sync, your iPhone is what merges the changes, and it passes the resulting list on to the watch.

Delete the Autheris app on the watch. That removes the app and its cached copy of your codes from the watch, and leaves your iPhone untouched. Turning iCloud Sync off is a separate thing — it does not remove the watch app.

• Check the device clock. TOTP codes are time-based; if your device’s time is more than about 30 seconds out, every code will be wrong. Settings → General → Date & Time → Set Automatically on iPhone and iPad, or System Settings → General → Date & Time on the Mac. On Apple Watch, leave Date & Time on Automatic — it follows the paired iPhone.
• Check the algorithm. Autheris defaults to SHA-1, which is what nearly every service uses. A few require SHA-256 or SHA-512 — edit the account and change the algorithm; the preview code updates as you change it.
• Check the digit count and period. Standard is 6 digits and 30 seconds. Some services use 7 or 8 digits.
• Check whether it is counter-based. A few services hand you a counter instead of a code that changes on a timer. That kind does not expire — it stays the same until it is spent — and its card shows which counter it is on with a Next Code button. If the service rejects the code, tap Next Code and use the new one. An account like this added by hand as a time-based one will always be rejected; scan its QR code or paste its setup link instead and Autheris adds the right kind.
• Check the secret. If the account was added by hand, a mistyped character will produce valid-looking but wrong codes. Re-add it by scanning instead.

They are almost certainly the same secret added twice — often one from a QR scan and one from an import. Delete the duplicate. Since 3.0, Autheris says “Already on this device” instead of adding a code you already have, and hides an exact copy (same name and same secret) from the list.

Settings → Security. Autheris locks when it opens and again 30 seconds after it is sent to the background. Those three privacy toggles — blur when backgrounded, hide codes in the app switcher, and hide codes while recording or mirroring — default to on.

On the Mac the same lock uses Touch ID where your Mac has it, and your login password where it does not.

You are probably recording or mirroring your screen (Screen Recording, AirPlay or a connected Mac). Autheris covers codes during capture by design. Stop the recording or mirroring and the codes reappear.

On the Mac there is no recording to detect, so the app instead keeps its windows out of screen capture altogether. Turn off Hide codes while recording or mirroring if you want to capture the app yourself.

On iPhone and iPad, iOS gives apps no notification when a screenshot is taken, so the privacy screen cannot cover it. Autheris protects against the app switcher, backgrounding and screen capture, and does not claim to block screenshots. Treat any screenshot of your codes as exposed.

The Mac is different: there is no signal either, so the app asks the system to keep its windows out of screen capture entirely. The app does not appear in a Mac screenshot at all — your own captures included.

Two supported routes:

• iCloud Sync — turn it on before switching, sign in to the same Apple ID on the new device, install Autheris and turn sync on. Secrets are end-to-end encrypted by CloudKit.
• Encrypted backup — Settings → Backup, create an AES-256-GCM backup with a password of at least 10 characters, save it somewhere you control, then restore it on the new device. Autheris shows what the restore will replace and asks before it does; codes it replaces go to Recently Deleted.

Because tokens are stored in the Keychain with “this device only” protection, they do not travel with an iCloud or encrypted Finder backup of the device.

There is no recovery — the file is encrypted with that password and nothing else. That is the point of the format, and why the password should go in a password manager when you create the backup.

No. Since 2.0, tokens, settings and deletion tombstones live in the Keychain, which survives deleting and reinstalling the app. A code you deleted also stays deleted across a reinstall.

• Sign in to iCloud — the device is not signed in to iCloud, or iCloud Drive is off for this Apple ID. Settings → [your name] → iCloud.
• Sync unavailable — iCloud Sync cannot start, usually because the build or its CloudKit container is not configured for this device. Try again on a release build from the App Store.
• Sync Paused — the device is offline. Local codes are always authoritative on screen; sync resumes when the network returns.

Settings → iCloud Sync → Delete Tokens from iCloud. This removes them from your other devices too. If you only want to stop syncing on this device, turn sync off and choose “keep the codes on this device”.

Pins sync because a pin is a property of the code. The order you drag codes into is deliberately per device, like arranging home screen icons — otherwise a single drag would rewrite many records at once and could drop a concurrent edit on another device.

Counters sync like anything else, with the newest edit winning. If two devices each spend a counter-based code before they sync, one of those two increments is lost — and a service usually accepts a few counters ahead, so the codes may still work. If one is rejected, tap Next Code until the service accepts a code again.

Google Authenticator, Aegis, andOTP and 2FAS export files, plus QR codes and setup links. Exports are usually a JSON file or a set of QR codes; Autheris reads both.

Counter-based accounts come across with the counter they were on, so the next code Autheris shows is the one the service expects — Google Authenticator, Aegis and andOTP included. 2FAS backups are the exception: their counter-based accounts are still skipped.

Imports are per-file and additive — nothing already in your list is removed, and Autheris shows what it will add before you tap Import. Re-run the import with the same file; codes that are already on your device are skipped, and the summary counts only the ones really added.