Ente Auth stores TOTP secrets and generates the rotating codes used for two-factor authentication. An entry can come from a QR code, a manually typed secret or a supported authenticator import. Tags, pins, search and notes organize those entries. Ente Auth does not validate a password at the service; it calculates a code from the stored secret and the current time.
Account mode and offline mode protect different losses
Account mode creates end-to-end encrypted backups and synchronizes authenticator entries across mobile, desktop and web clients. A new signed-in device can receive the encrypted collection through that account. Offline mode requires no Ente account and keeps the authenticator data on the device.
Offline mode avoids an account dependency, but it deliberately omits account-based cloud backup and cross-device synchronization. Losing or resetting that device without a separate export can remove the only copy of the TOTP secrets. Account mode addresses device loss but still depends on access to the Ente account and its recovery path.
An encrypted export needs its own password
Ente Auth can create an encrypted export. It derives a key from the export password with Argon2id and encrypts the data with XChaCha20-Poly1305 authenticated encryption. Import or decryption later requires that export password. The Ente account password does not automatically replace a forgotten export password.
The command-line client can create automated backups and can decrypt or import an encrypted export. Automation makes regular copies possible, but it also creates a directory whose retention and access need deliberate control. A backup that never leaves the same failing disk does not address device loss.
A decrypted export contains the actual secrets
A decrypted export consists of newline-separated otpauth URIs. Those URIs contain the raw secrets needed to generate the same codes. Anyone who obtains the file can reproduce the stored one-time codes on another authenticator.
This makes a decrypted export useful for migration and dangerous as a long-term casual backup. Sending it through ordinary email or leaving it in a downloads folder removes the protection that Ente Auth applies inside the account. After a migration, the user can protect or remove that plaintext file according to the recovery plan.
Copying codes does not rotate the underlying secret
Revealing the next code helps when the current token will expire during login. Tags and pins change presentation rather than the cryptographic seed. Deleting an entry from one synchronized client can propagate the removal, while deleting an offline entry can remove the only local copy.
If a TOTP secret becomes exposed, removing it from Ente Auth is not enough. The service that issued the secret must replace or disable it. Ente Auth manages the authenticator copy; the service controls whether that seed remains valid for account access.
