Steam Guard without a smartphone
Two different questions hide inside this one, and mixing them up is why the answers you find online contradict each other. One is about the device that generates codes. The other is about the phone number on your account — and those have very different answers.
Valve's supported answer is that a phone is required. The official mobile authenticator needs a supported phone, and Steam expects a confirmed phone number on the account. Anything on this page about working around that describes unofficial software and undocumented behaviour, not a supported configuration.
Question 1: does the authenticator have to run on a phone?
No. An authenticator is a secret plus a clock, and a desktop can hold both — that is what desktop authenticators are, and they have existed for years. But note this is a move, not an addition: Steam allows one authenticator on an account at a time.
Question 2: can the account have no phone number at all?
Usually not, and you should plan on needing one. When software asks Steam to attach an authenticator, Steam normally wants a confirmed number on the account and texts a code to it. Without one, the common outcome is a flat refusal telling you to add and verify a number first. Adding a number is done on Steam itself — no third-party tool can do it for you, and any offering to should be closed immediately.
There is a documented-nowhere exception we have seen in practice: some accounts without a phone still complete enrolment, and Steam delivers the activation code by email instead. Our own enrolment handles both, deciding which to expect from Steam's response rather than assuming SMS, and a live run against an account with no phone confirmed the email path works.
Do not plan around it. One confirmed instance is not a feature: it is undocumented, appears to depend on the account, and Valve could change it tomorrow without telling anyone. Treat it as a pleasant surprise if it happens to you, and assume the refusal otherwise.
The recovery problem this creates
A phone number is the easiest way back into a locked-out account. Without one, losing your authenticator means the recovery code or a Steam Support ticket that takes days. If you are deliberately running without a number, writing the recovery code down stops being good practice and becomes the only thing standing between you and support.
The configuration that actually works well
If you have a phone but will not install the app — a common and reasonable position — keep the number on the account for recovery and let a desktop tool generate the codes. You keep Steam's easy recovery path and get codes and confirmations on the machine you are already using. That is the setup a desktop authenticator suits best, and it sidesteps everything difficult above.
What you are taking on
Honestly: responsibility for a file. On a phone the secret is sealed inside an app; on a PC it is data you can back up, and equally data you can leak. Open Desktop Authenticator keeps it encrypted with a passphrase and locks itself when idle, but no design removes the underlying fact — and if a smartphone is genuinely an option for you, the official app is still the simpler answer.