Uninstall Open Desktop Authenticator, and remove its data

Reviewed 26 September 2026 by MASTERPANEL LLC 4 min read Sources and testing: Version covered: ODA 1.5.1. Installed and portable data roots checked against the tagged application path setup; vault and backup names against storage; recovery paths against recovery; package behavior against the release configuration Editorial method

Removing the application is the easy half. The half worth reading first is what happens to the Steam accounts it was holding, because uninstalling does not touch them.

Do this before you delete anything#

Uninstalling does not remove the authenticator from your Steam account. Steam still expects codes from an authenticator this application was generating. Deleting your only usable copy can leave you unable to sign in until you complete Steam's recovery process.

Either, for each account:

Verify access elsewhere — check another working copy of the authenticator, or make and test a secure export or backup before removing this one. Uninstalling ODA does not require disabling Steam Guard.
If you intend to deactivate it, use Remove account and explicitly select Also remove the authenticator from Steam. Ordinary removal only removes the vault entry. Deactivation needs the revocation code and your passphrase; it can cause Steam trading restrictions. Read the consequences first.
Or make sure you have the revocation code — the R code Valve calls your recovery code, written down somewhere that is not the vault. What it is and how to get it back. With it you can detach the authenticator from Steam later, without this application.

If you have no working copy or usable backup and the vault is already gone, the recovery routes are here.

1. Remove the application#

Microsoft Store: Start menu, right-click Open Desktop Authenticator, Uninstall. Or Settings, Apps, Installed apps. Back up your data first: package removal may also remove Windows-managed package data.
Windows installer (the .exe from GitHub): Settings, Apps, Installed apps, Open Desktop Authenticator, Uninstall. The uninstaller deliberately leaves your data behind so that removing the program does not also remove your stored authenticator secrets.
Windows portable: A portable build has no installer. Delete the .exe and the open-desktop-authenticator folder beside it, which is where it keeps the vault, settings, recovery records and other normal application data. While it runs, the single-file launcher also extracts Electron and Chromium runtime files to Windows Temp; it normally removes that runtime-only stage on exit.
Linux AppImage: Quit ODA and delete the .AppImage file. Remove any launcher or shortcut you created, then deal with application data below.
Linux .deb: sudo apt remove open-desktop-authenticator, or sudo dpkg -r open-desktop-authenticator. As with the Windows installer, your data is left alone.

2. What is left, and where#

This project operates no server that stores a copy of your vault or account data. The application's persistent data lives in the directory below. Requested authenticator and confirmation operations send the necessary requests to Steam, and the optional update check contacts GitHub when it is enabled. The privacy page names those destinations and what they receive.

Windows, installed from GitHub: %APPDATA%\open-desktop-authenticator
Microsoft Store: Windows may redirect the application's data into the package's private storage under %LOCALAPPDATA%\Packages. Check the ODA package's LocalCache\Roaming\open-desktop-authenticator directory as well as the installed path above. Locate and back up the actual vault before uninstalling; do not delete other applications' package folders. Microsoft documents this possible AppData redirection.
Windows, portable: open-desktop-authenticator, in the same folder as the .exe
Linux: ~/.config/open-desktop-authenticator by default, or $XDG_CONFIG_HOME/open-desktop-authenticator when that environment variable overrides the configuration directory.

Inside it:

vault.json: Your accounts and their Steam secrets, encrypted with your passphrase. This is the file that matters.
vault.json.bak: The previous saved version, kept to help recover from a failed write. Encrypted too, and just as usable to somebody who has your passphrase — deleting only vault.json leaves this behind.
recovery/: .oda-recovery files created for imported, enrolled or transferred authenticators. They contain account secrets and any recovery code, not just the recovery code. Each is encrypted using the vault key in force when that file was written. Older copies may need an older passphrase, and a later authenticator transfer can make an old file's secrets obsolete.
Other application files: Interrupted-operation records, recovery staging files and Chromium data can also live here. Remove the whole ODA data directory when you intend to remove its local data, not only the three entries listed above.

3. Remove the data#

Quit ODA completely, including its tray icon, then delete its data directory if it remains after uninstalling. This removes that local copy. Check any other installation or portable folder, exports and backups separately. Files in the Recycle Bin, system backups or cloud-synced folders can remain recoverable; ordinary deletion is not a secure-erasure guarantee.

Vault and recovery contents are encrypted. Other application data is not necessarily encrypted in the same way. Keep the encrypted backups you still need for access, with their passphrases stored separately.

Exports you made are not in there. A .maFile you exported went wherever you saved it, and those are unencrypted unless you encrypted them yourself. If you were leaving for another authenticator, that file is the one you are keeping; if you were not, it is the one to delete first.

Licence#

Open Desktop Authenticator is free software under the MIT licence — you may use, copy, modify and redistribute it, and it comes with no warranty. Read the licence. There is no separate ODA end-user agreement or ODA account, and nothing to cancel.