Steam Desktop Authenticator: what it is, and how to use it safely

Steam Desktop Authenticator — almost always shortened to SDA — is a Windows program that implements Steam's mobile-authenticator functions on a computer. It is not Valve's phone-transfer feature. This page explains what it does, what it stores, why the search results for it are dangerous, and what your options are. It is not a download page for SDA, and we are not its authors.

What Steam Guard actually is#

When you enable Steam Guard Mobile Authenticator, Steam gives your device two long-lived secrets and keeps a copy:

shared_secret

The seed for the five-character login codes. It is a time-based one-time password: your device and Steam both hash the secret together with the current thirty-second window, and get the same answer without ever talking to each other. Anyone holding this secret can generate your login codes for as long as that authenticator stays on the account — it does not expire on its own, and only removing or replacing it stops them.

identity_secret

The seed used to authenticate trade and market-confirmation requests. With this secret and a valid session, software can approve a pending confirmation; the secret alone cannot initiate a trade or create a logged-in session.

The revocation code

A short code in the form R12345, which Valve now calls your recovery code. It is shown during setup and can be retrieved again while the authenticator is still accessible. It is how you detach the authenticator if you lose the device. If you do not have it and you lose your authenticator, a linked phone number or previously generated backup codes may still help. Otherwise use Steam Support's recovery process.

What a maFile is#

SDA stores each account in a file named after the SteamID with a .maFile extension. It is JSON, and a typical one carries the authenticator secrets and account metadata above, and may also hold session data that has not expired. In other words: a maFile is the account's second factor, in a file, on disk.

SDA can encrypt maFiles with a passphrase. When it does, the file contents are base64 ciphertext and the salt and initialisation vector live beside it in manifest.json — which is why an encrypted maFile cannot be decrypted without that manifest, and why copying only the .maFile to a new machine leaves you with something you cannot open.

Why people use a desktop authenticator at all#

Steam's own mobile app is the intended route, and for most people it is the right one. Traders reach for a desktop tool for reasons that are practical rather than exotic:

• Managing confirmations alongside a desktop trading workflow can reduce switching between devices. Bulk controls depend on the application and version.
• A desktop code can be copied locally. Valve's mobile app also offers QR sign-in and sign-in approval, so using a phone does not always mean retyping a code.
• Accounts outlive phones. People who have lost an authenticator to a broken handset tend to want the secret somewhere they control.

The trade-off continues after downloading: storing the Steam session and its authenticator on one computer exposes both to malware on that computer. A separate phone reduces that shared exposure, although it does not prevent phishing.

Looking for the Steam Desktop Authenticator download?#

If you take one thing from this page, take the two minutes to check what you downloaded before you open a .maFile with it:

1. Confirm the address. Releases live on the same repository as the source. A download page that has no source attached to it has nothing tying the file to the project.
2. Compare a checksum against a trusted release record, if provided. A hash beside a file detects a mismatch but does not independently authenticate its publisher. Our guide explains the distinction; ODA's signing and attestation commands do not apply to SDA. Check which verification files the original SDA release actually supplies. Do not assume it provides ODA's signature or provenance records. If it does not provide an authenticated checksum, there is no checksum-origin check to perform; start from the Jessecar96 repository linked above and retain the unsupported-software warning.
3. Never enter a maFile, password or API key into a web page offering to check, repair or convert it.

We publish an independent alternative, which gives us a stake in this comparison. Our recommendation for most people remains Valve's mobile app. Download provenance does not make unsupported SDA a maintained product.

Why searching for "steam desktop authenticator download" is the dangerous part#

SDA is distributed as source and as releases on its project page. The name, however, is generic enough that a great many other sites rank for it, and some of them may distribute unofficial or modified builds. SDA's own README warns about counterfeits. The following is a possible attack path, not a measurement of current search rankings or the behavior of every clone:

1. A site that looks like a product page, often with a stolen screenshot.
2. A file served directly by an unrelated website, rather than a link to the official Jessecar96 release page. SDA itself ships as a zip, so the archive is not the warning sign — who is handing it to you is.
3. A build can generate correct codes while copying your maFile or retaining the passphrase you enter. Functionality does not prove safety.
4. The attacker may use copied credentials immediately or later. A quiet period does not mean the file was safe.

We have written up the specific patterns and what to check for, because the single most useful thing this project can do for somebody is make them harder to rob, whether or not they ever use our software.

Your options, honestly#

How this project relates to SDA#

ODA is a separate implementation, not an official SDA release or an endorsed successor. It is built in the open and reads the same .maFile format so that nobody is trapped by their choice of tool. If you decide to leave, the application exports your accounts back out in the same format. A security tool that holds your secrets hostage is not a security tool.

Related reading#

• How the fake SDA sites work
• What is inside a maFile
• If SDA's codes are being refused
• Encrypted maFiles and the manifest
• How the options compare
• If you have already lost access
• Verifying that a download is genuine
• Moving maFiles into this application
• What this application does with your secrets