Status: 1.5.0, in the Microsoft Store and on GitHub#
Open Desktop Authenticator 1.5.0 is published in the Microsoft Store and on this project's GitHub releases page. The download page links both official channels. This page still hosts no installer and never will — every button here links outward.
What is still missing is written down rather than left for you to find: the direct downloads carry no code-signing certificate, and none is planned, builds are not yet reproducible, and no independent audit has happened. The download page tracks each of those.
Code signing policy: Store package signing, unsigned direct downloads and checksum-list signatures — read it here.
Why this exists#
Steam Desktop Authenticator — SDA — brought Steam Guard to PCs and helped inspire this project. Its authors now warn that it is unmaintained and unsafe to use. Counterfeit downloads are an additional risk: malicious builds can copy the authenticator secrets inside a maFile and put your account and inventory at risk. A familiar name, search ranking or working code display does not establish that a download is genuine. Read the evidence and the checks to make.
We think the answer is a tool where the dangerous parts are visible. Everything in this application that touches a secret is readable in the open, it is built in public CI from that source, and the site tells you how to check a download against what was published. Reproducible builds — where you compile the tag yourself and get the same bytes — are the goal and are not finished; the download page tracks what is actually done.
What it does#
Steam Guard codes#
The five-character code, regenerated every thirty seconds, with the time remaining shown as it drains. Copy puts it on the clipboard and attempts to clear that entry on a timer. Clipboard history and other apps' copies are outside that clearing.
Trade and market confirmations#
Approve or cancel the confirmations Steam would otherwise send to a phone. Optional automatic confirmation is limited to market listings and trades, and cannot be widened to cover account-recovery requests.
Import from SDA#
Reads .maFile accounts, including encrypted ones with their
manifest.json. Nothing is written to your vault until you
choose what to keep. How importing works.
An encrypted vault#
Secrets are sealed with a key derived from your passphrase using scrypt, then encrypted with AES-256-GCM. The vault locks itself when you stop using it. The full security model.
Adding a new authenticator#
Move Steam Guard onto this app for an account that does not have an authenticator yet, including the revocation code you must write down and confirm you have saved outside this computer. Complete Steam's separate activation challenge as shown by the app.
Recovery that exists in advance#
Encrypted account recovery files are created during import, enrollment and transfer, and retained after a vault entry is removed. They need the passphrase used when written. Keep an independent backup: a file on the same disk cannot protect you from losing that disk.
What it will not do#
A short list, because the things a security tool refuses to do are more informative than the things it offers.
- No ODA backend. No ODA account. No cloud sync. No telemetry. Steam operations you request contact Valve and send the data needed for that operation. In a direct GitHub build, the optional update check asks GitHub's public releases API whether a newer version exists; GitHub receives that request and its source IP, but no Steam account or vault data. Store builds do not perform that GitHub check. The in-app browser is the deliberate exception: its web pages have no vault API access and can load external resources. The browser holds login cookies scoped to Steam domains so Steam pages open signed in; those cookies are not sent to arbitrary third-party sites. The selected browser route determines which traffic uses the account's proxy; Steam-only mode permits specified third-party sites to connect directly. The routed in-app browser is available in GitHub 1.5.0 and Microsoft Store 1.5.0. The security model sets out what each part can access.
- Direct downloads are updated manually. If enabled, the GitHub update check reports a newer version and links to its release; it does not download or install it. The Microsoft Store manages updates for the Store edition, subject to your Store settings.
- It never auto-confirms an account-recovery request. Automatic confirmation works from a fixed allowlist of two types — trades and market listings — and account recovery is not on it and cannot be added by a setting. Those two types can still move items and money, which is why the feature is off until you turn it on, per account, and why the security model describes what it costs you.