Two-factor authentication
Your two-factor codes, wherever you need them.
Zesam keeps the codes your services ask for on top of your password: two-factor authentication, or 2FA. On Mac, iPhone and iPad, synced through your own iCloud and nobody else's.
For iPhone and iPad. Coming soon to the Mac App Store.
Hostinger
romain@example.com
30 s, then a new one
What Zesam does
01 · the essentials
Codes you can read
Tabular figures, a gauge that empties along the edge of the card, and the next code announcing itself in the final seconds, so you never again copy a code that flips under your fingers.
A QR code from an image
Photo, screenshot, PDF: Zesam reads the QR code inside. No more need for a second phone to photograph the screen of the first, which is precisely what most competing apps cannot do.
A code from the browser
The extension recognises the site you are on and hands you its code without leaving the page or opening another app. Safari, Chrome and Firefox.
Backup codes
The ones you file away and never find again. Zesam keeps them beside the account they belong to, and marks the ones already spent.
Folders and tags
Two levels of folders, not three. A deep hierarchy files beautifully on day one and is unfindable by day thirty.
Travel mode
You choose which accounts to hide; the switch makes them vanish from folders, from search, even from the counters. Face ID is required in both directions, and it is the “off” direction that matters: nobody can reveal them on a device handed over already unlocked.
Import and export
From competing apps, by QR code or by file. And an encrypted export, sealed with your own passphrase, that only you can reopen.
How Zesam protects your secrets
02 · security
A two-factor app guards what is left once the password has leaked. Here is exactly what it uses: not adjectives, algorithm names.
| What is protected | By what |
|---|---|
| Your secrets and backup codes | The system keychain. Encrypted at rest, and end-to-end encrypted by Apple when it travels through iCloud; Apple does not hold the key. |
| The codes themselves | TOTP, RFC 6238. SHA-1, SHA-256 and SHA-512 supported. |
| Your exported backups | AES-256-GCM. The key is derived from your passphrase with PBKDF2-HMAC-SHA512, 650,000 iterations, and a 32-byte random salt. |
| A backup's work factor | The header is authenticated together with the contents: nobody can lower the iteration count on a stolen backup to attack it faster. An implausible value is refused rather than silently decrypted. |
| Unlocking | Face ID, Touch ID or the device passcode. Zesam receives only a yes or a no, never your biometrics. |
Four rules the code has followed from its first line
- No home-made cryptography. Everything comes from CryptoKit, Apple's own library. A primitive written for the occasion is the most common way to break a security app.
- No secret written to disk in the clear. No temporary file, no cache, no log, no error message, not even for the length of a write.
- No third-party dependencies. Every outside library would be one more door to watch, and one more update nobody reads.
- No secret in the synced database. It holds names and join identifiers only. Secrets travel by the other channel, the keychain.
What Zesam does not do
- No analytics, no telemetry. No audience measurement, no usage reports, no “anonymised data”.
- No account to create. Zesam has no server, so there is nothing to sign up for.
- No advertising, no trackers.
- It is not a password manager. Zesam fills in no passwords and does not try to replace Apple's own.
Wherever you need it
03 · your devices
A native app, written for each platform rather than ported from one. Home screen widgets, instant search from the Mac menu bar, Shortcuts, and an extension that shows the code for the site you are on.