Steam Desktop Authenticator: what it is, and how to use it safely
Steam Desktop Authenticator — almost always shortened to SDA — is a Windows program that moves Steam Guard off your phone and onto your computer. This page explains what it does, what it stores, why the search results for it are dangerous, and what your options are. It is not a download page for SDA, and we are not its authors.
The official SDA is at github.com/Jessecar96/SteamDesktopAuthenticator. It is written by Jessecar96 and that repository is its only real home. Everything else calling itself SDA — a lookalike domain, a "mirror", an installer from a forum post, a sponsored search result — is somebody else's software with somebody else's motives.
Official releases →What Steam Guard actually is
When you enable Steam Guard Mobile Authenticator, Steam gives your device two long-lived secrets and keeps a copy:
shared_secret- The seed for the five-character login codes. It is a time-based one-time password: your device and Steam both hash the secret together with the current thirty-second window, and get the same answer without ever talking to each other. Anyone holding this secret can generate your login codes forever.
identity_secret- The seed used to sign trade and market confirmations. This is the one that approves a trade. Someone with your identity secret and a session can accept trades on your behalf.
- The revocation code
-
A short code, usually shown once, in the form
R12345. It is how you detach the authenticator if you lose the device. If you do not have it and you lose your authenticator, recovering the account means Steam Support and a wait measured in days.
What a maFile is
SDA stores each account in a file named after the SteamID with a
.maFile extension. It is JSON, and it contains all three of the
items above plus the session tokens. In other words: a maFile is the
account's second factor, in a file, on disk.
SDA can encrypt maFiles with a passphrase. When it does, the file contents are
base64 ciphertext and the salt and initialisation vector live beside it in
manifest.json — which is why an encrypted maFile cannot be
decrypted without that manifest, and why copying only the .maFile
to a new machine leaves you with something you cannot open.
The practical consequence: treat a maFile exactly as you would treat the password to the account, because it is worth more. A password can be changed. A shared secret that someone else has copied works until you detach the authenticator entirely.
Why people use a desktop authenticator at all
Steam's own mobile app is the intended route, and for most people it is the right one. Traders reach for a desktop tool for reasons that are practical rather than exotic:
- Confirming twenty market listings on a phone means twenty taps on a phone. On a desktop it is a list and one button.
- A code you can copy is faster and less error-prone than a code you read off a phone screen and retype.
- Accounts outlive phones. People who have lost an authenticator to a broken handset tend to want the secret somewhere they control.
All of that is legitimate. The risk is not in wanting a desktop authenticator. The risk is in how you get one.
Looking for the Steam Desktop Authenticator download?
Get it from the project's own repository, and nowhere else: github.com/Jessecar96/SteamDesktopAuthenticator. SDA is released there by Jessecar96. Any other site offering a “Steam Desktop Authenticator download” — an installer, a zip, a mirror, a “fixed” or “updated” build — is not the project, whatever the page looks like.
If you take one thing from this page, take the two minutes to check what you
downloaded before you open a .maFile with it:
- Confirm the address. Releases live on the same repository as the source. A download page that has no source attached to it has nothing tying the file to the project.
- Compare the checksum against the one published on the release page — not one printed beside the download by whoever served it. The exact commands are here, and they work for any project, not just ours.
- Never enter a maFile, password or API key into a web page offering to check, repair or convert it.
We publish an independent alternative and would rather you used it, but not at the cost of being unclear here: using SDA safely is better than using anything unsafely. If SDA is what you want, get it from its own releases and verify it.
Why searching for "steam desktop authenticator download" is the dangerous part
SDA is distributed as source and as releases on its project page. The name, however, is generic enough that a great many other sites rank for it, and a meaningful share of them exist to hand you a modified build. The pattern is consistent and worth recognising:
- A site that looks like a product page, often with a stolen screenshot.
- A download that is an installer or a zip rather than a link to a release page with checksums.
- A build that works. It really does generate codes — that is the point, because a tool that failed would be uninstalled. It also copies your maFile out.
- Nothing happens for weeks. Then the inventory is gone during a window when you were not looking.
We have written up the specific patterns and what to check for, because the single most useful thing this project can do for somebody is make them harder to rob, whether or not they ever use our software.
Your options, honestly
Steam's mobile app
Official, maintained by Valve, and the safest default. If you are not trading in volume and you are not sure what a maFile is, this is the answer and you can stop reading.
SDA itself
A real project with real users. If you use it, get it from its own source repository and its own releases — never from a search advertisement, a YouTube description, or a Discord message.
This project
An independent, open-source alternative, written to be checkable: public source, reproducible builds, published checksums, and no self-updating. Not yet released.
How this project relates to SDA
It does not share code with SDA and is not endorsed by its authors. It is a
separate implementation of the same idea, built in the open, and it reads the
same .maFile format so that nobody is trapped by their choice of
tool. If you decide to leave, the application
exports your accounts back out in the same
format. A security tool that holds your secrets hostage is not a security
tool.