Support

Tap Add on the home screen, then scan the QR code the service shows you when enabling two-factor authentication. If you already have a setup link (otpauth://…), paste it in instead — or choose a screenshot of the QR code from your photo library. The account name is optional.

iOS 16.0 or later on iPhone. Face ID or Touch ID requires the matching hardware; everything else works without it.

Yes — codes are generated entirely on device. The network is only used when you enable iCloud Sync or when the app looks up an issuer’s logo.

• Check the device clock. TOTP codes are time-based; if your iPhone’s time is more than about 30 seconds out, every code will be wrong. Settings → General → Date & Time → Set Automatically.
• Check the algorithm. Autheris defaults to SHA-1, which is what nearly every service uses. A few require SHA-256 or SHA-512 — edit the account and change the algorithm; the preview code updates as you change it.
• Check the digit count and period. Standard is 6 digits and 30 seconds. Some services use 7 or 8 digits.
• Check the secret. If the account was added by hand, a mistyped character will produce valid-looking but wrong codes. Re-add it by scanning instead.

They are almost certainly the same secret added twice — often one from a QR scan and one from an import. Delete the duplicate.

Settings → Security. Autheris locks when it opens and again 30 seconds after it is sent to the background. Those three privacy toggles — blur when backgrounded, hide codes in the app switcher, and hide codes while recording or mirroring — default to on.

You are probably recording or mirroring your screen (Screen Recording, AirPlay or a connected Mac). Autheris covers codes during capture by design. Stop the recording or mirroring and the codes reappear.

iOS gives apps no notification when a screenshot is taken, so the privacy screen cannot cover it. Autheris protects against the app switcher, backgrounding and screen capture, and does not claim to block screenshots. Treat any screenshot of your codes as exposed.

Two supported routes:

• iCloud Sync — turn it on before switching, sign in to the same Apple ID on the new iPhone, install Autheris and turn sync on. Secrets are end-to-end encrypted by CloudKit.
• Encrypted backup — Settings → Backup, create an AES-256-GCM backup with a password you choose, save it somewhere you control, then restore it on the new device.

Because tokens are stored in the Keychain with “this device only” protection, they do not travel with an iCloud or encrypted iTunes/Finder backup of the phone.

There is no recovery — the file is encrypted with that password and nothing else. That is the point of the format, and why the password should go in a password manager when you create the backup.

No. Since 2.0, tokens, settings and deletion tombstones live in the Keychain, which survives deleting and reinstalling the app. A code you deleted also stays deleted across a reinstall.

• Sign in to iCloud — the device is not signed in to iCloud, or iCloud Drive is off for this Apple ID. Settings → [your name] → iCloud.
• Sync unavailable — iCloud Sync cannot start, usually because the build or its CloudKit container is not configured for this device. Try again on a release build from the App Store.
• Sync Paused — the device is offline. Local codes are always authoritative on screen; sync resumes when the network returns.

Settings → iCloud Sync → Delete Tokens from iCloud. This removes them from your other devices too. If you only want to stop syncing on this iPhone, turn sync off and choose “keep the codes on this device”.

Pins sync because a pin is a property of the code. The order you drag codes into is deliberately per device, like arranging home screen icons — otherwise a single drag would rewrite many records at once and could drop a concurrent edit on another device.

Google Authenticator, Aegis, andOTP and 2FAS export files, plus QR codes and setup links. Exports are usually a JSON file or a set of QR codes; Autheris reads both.

Imports are per-file and additive — nothing already in your list is removed. Re-run the import with the same file; duplicates are easy to spot and delete.