Everyday codes, deliberate controls.

01 · First run

Create the encrypted vault.

1. Create and confirm a strong master password.
2. Keep that password somewhere safe. It remains the recovery method even when biometric quick unlock is enabled.
3. If strong biometrics are available, approve the Android system prompt offered immediately after setup. Cancelling it leaves the password-protected vault fully usable.

02 · Accounts

Tap, search or swipe.

Tap an account row

Copy its current six-digit code. The banner confirms the action and disappears automatically.

Swipe right

Reveal the account’s Show QR and Edit actions.

Swipe left

Open a confirmation before deleting the account.

Search

Filter the vault by issuer or account name without changing stored accounts.

Add or edit

Enter issuer, optional account name and Base32 secret. Expand advanced options only when a provider uses a non-standard TOTP period.

03 · QR workflows

Scan in. Show out.

Import with the camera

Use the camera action to photograph a standard otpauth:// account QR code. OTP Harbor validates the payload before changing the vault and asks how to resolve a changed existing account.

Move from Google Authenticator

In Google Authenticator, choose Transfer accounts or Export accounts. Scan every generated transfer QR code in order. Multi-account and multi-page transfers are supported one QR code at a time.

Show an account QR code

Swipe an account right and choose Show QR. The displayed QR contains that account’s secret. Use it only with a trusted authenticator and hide it immediately afterward.

04 · Portability

Encrypted backup and restore.

1. Open Settings → Import / Export.
2. For export, enter and confirm a separate backup password, then choose the destination through Android’s document picker.
3. For import, choose a .totp file and enter its backup password.
4. Identical accounts are left unchanged. For changed accounts, review each difference and choose whether to keep the current version or restore the backup version.

Desktop and Android use the same encrypted backup format. Test a backup before relying on it for recovery.

05 · Security

Choose your unlock posture.

Choose the primary unlock method

Security settings offer strong biometrics, the Android device screen lock (PIN, pattern, or password), and the master password. Biometrics are the default after first-run setup when available. OTP Harbor does not create a separate PIN; it delegates screen-lock verification to Android. The master password remains available if a platform key becomes unavailable.

App lock

App lock is enabled by default. A normal app switch has a 30-second grace period, while device locking removes displayed codes and locks immediately.

Turn authentication off

You may deactivate app lock in Security settings only after reading the warning and confirming the master password. With authentication off, anyone using the already-unlocked device can open OTP Harbor and view its codes. Re-enable app lock to restore the last selected authentication method; platform methods require the master password once to recreate their protected key.