Download

Two places, and nowhere else#

Open Desktop Authenticator 1.5.1 is published in the Microsoft Store and on this project's GitHub releases page. Those are our two official download channels. Follow those exact listings rather than a mirror or a lookalike domain. This site links to the downloads; it does not serve an installer itself. The full list of addresses we publish from is short, and anything outside it is not ours.

Microsoft Store 1.5.1 Signed Windows 1.5.1 on GitHub

GitHub 1.5.1 Windows downloads are signed by MASTERPANEL LLC using Microsoft Azure Artifact Signing. Choose an x64, ARM64 or combined installer, or the portable x64 build. Check the publisher signature.

Microsoft signs ODA's Store AppX package and checks its integrity during installation. This avoids the SmartScreen download warning associated with direct downloads; it is not a guarantee that an application is safe. Check that the listing names MASTERPANEL LLC as publisher. Store updates can install automatically, subject to your Store settings. Microsoft's package-signing requirements and update settings explain those checks.

The Store 1.5.1 package recorded in our publication record is x64. Windows 11 on Arm supports x64 emulation. For a native ARM64 build, use the ARM64 installer on the GitHub 1.5.1 release; the Store does not currently offer a native ARM64 ODA package.

Download 1.5.1 for Linux

An x64 AppImage and a Debian/Ubuntu .deb, published on the releases page. There is no native Linux ARM64 package in this release. Verify the downloaded file using the checksums, checksum-list signature and build provenance attestation.

Portable builds and direct-download details

Direct installation packages are on the GitHub 1.5.1 release page, including the portable build, which has no Store equivalent — its vault, settings and recovery data stay beside the executable, so it can run from a USB stick. The single-file launcher extracts Electron and Chromium runtime files to Windows Temp while it runs and normally removes them on exit. Use this route if the Store is unavailable or you need a portable build. An organisation's device policy may still block an application; a portable build does not bypass that policy.

The direct Windows downloads are code-signed and timestamped as MASTERPANEL LLC using Microsoft Azure Artifact Signing. Check for a valid signature and that publisher name before running the file. SmartScreen may still warn, and device policy may block a signed application. An unrecognised-app warning and a malware detection are different findings; a signature is not a reason to dismiss a security alert. The verification steps establish the published origin of a file, not whether its code is harmless.

What to use today#

Start with Valve's app. If you specifically need a desktop tool, compare the alternatives and their limitations before installing:

Steam's official mobile authenticator. Maintained by the people who run the service, distributed through Apple's and Google's own stores. Valve provides account-recovery routes if the phone is lost. Use Valve's mobile-app page to find the store links. If you are here because you searched for a desktop authenticator, this is still probably what you want.
The original Steam Desktop Authenticator: a legacy option we do not recommend for a new setup. Its own README says it is no longer supported and will not receive any more updates, and its authors' position is that Steam's official mobile app is what its authors now tell people to use. That is their assessment of their own software and it deserves more weight than ours. Unmaintained software that holds a Steam Guard secret does not get safer with time. If you use it anyway, take it from github.com/Jessecar96/SteamDesktopAuthenticator and nowhere else — not a mirror, not a lookalike domain, not a sponsored result.
This project. There is a release to check now, and the links at the top of this page are it. We still put Valve's own app first, because for most people it is the better answer and saying otherwise to win an install would be the same mistake in the other direction.

We would rather lose you to Valve's app than have you install something abandoned on our recommendation. Sending people to unmaintained security software while leaving out its author's own warning is the behaviour this site exists to complain about.

Read SDA's own notice →

Why this page still lists the alternatives#

Because the reason this project exists is that somebody searching for a desktop authenticator lands on a page and installs whatever it offers. A download page that answers only "install ours" trains exactly that habit, which is the habit that costs people their inventories. Naming the alternatives, and the real home of each, is worth more than the installs it loses us.

What is finished#

Implemented features: codes, confirmations, enrollment, import and export, encrypted vault and recovery files.
The security posture described on the security page.
An automated test suite configured to run on pushes to main and pull requests.
Windows installers and the portable executable signed and timestamped as MASTERPANEL LLC using Microsoft Azure Artifact Signing. Linux packages use the checksum-list signature and provenance checks below; they do not carry a platform code signature. Read the signing policy.
A signature over the checksum list: the current GitHub release carries SHA256SUMS.txt.sig and the certificate that goes with it, so you can check that the list itself came from our workflow rather than only that your download matches the list. Step 5 walks through it.
Maintainer testing against live Steam accounts, documented in the protocol findings and the transfer record. The transfer record covers sign-in, a real transfer, codes and fetching the confirmation list; it explicitly does not claim a live approval of a pending trade. These records and automated tests are not an independent audit.

What is still missing#

Stated here rather than left for you to discover:

Reproducible builds. You cannot yet rebuild the tag and compare bytes with ours. The provenance attestation identifies the build workflow and commit; it does not substitute for an independent rebuild.
An independent audit. The project has maintainer test records and automated checks, but no published independent security audit.

Free software under the MIT licence — no ODA account or subscription, and nothing to cancel. Read the licence, or read how to remove it and its data before you install rather than after.

Building it yourself#

The source is public and can be built and run by anyone comfortable with Node.js. You no longer have to — there are builds now — but the option is the point: the public source lets you inspect the implementation behind a release. That inspection still requires expertise; public code alone is not a security assessment.

View the source repository

Installing a verified Linux download#

Choose one package. On Debian or Ubuntu, from the download directory, run sudo apt install ./open-desktop-authenticator-1.5.1-amd64.deb. For the AppImage, enable its executable permission in your file manager, or run chmod +x ./open-desktop-authenticator-1.5.1-x86_64.AppImage, then open it. Run ODA as your normal user. If it does not launch, report the error and your distribution/version through support.

Checking what you downloaded#

Each application download is listed with a SHA-256 checksum in SHA256SUMS.txt on the release page, alongside a build provenance attestation that ties those exact bytes to the public workflow run that produced them. The verification steps walk through both — worth reading once before you need them rather than in a hurry afterwards.