Native iOS two-factor authentication app for generating and managing Time-based (TOTP) and HMAC-based (HOTP) one-time passwords, with QR-code scanning, secure Keychain storage, and a PIN-protected passcode lock.
HyID is a native iOS authenticator built as a rebranded evolution of the open-source Tofu app. It gives users a self-hosted, privacy-first second factor: generate and manage one-time passwords (HOTP/TOTP per RFC 6238) for any service, stored securely in the Keychain.
Authenticator functionality demands cryptographic precision and security hardening: implementing HOTP/TOTP generation across HMAC-SHA1 / SHA-256 / SHA-512, scanning setup QR codes via AVFoundation, and storing secrets with a PIN-gated PasscodeLock rather than plaintext defaults.
Delivered a clean Swift app with QR-code enrollment, time-based and counter-based code refresh, a passcode lock screen for at-rest protection, and Keychain-backed secret storage. The project was rebranded from the Tofu open-source codebase under the HyID identity while preserving cryptographic correctness.
Produced a production-ready, offline-capable authenticator that protects user accounts with standards-compliant one-time passwords, hardened storage, and local PIN gating — no server dependency and no cloud storage.
