Clockwork

Clockwork generates two-factor codes (TOTP, RFC 6238) entirely on your device. The Android app declares no INTERNET permission — it cannot go online, and you can check that claim yourself in the manifest.

The app is the project's single-file web build carried by a system WebView: the same clockwork.html you can download from a release and open on any computer.

What it does:

* Generates TOTP codes — SHA-1, SHA-256 or SHA-512, 6 to 8 digits, any period. The countdown is a 30-mark dial with a rotating hand, not a progress ring.
* Takes input in every shape you are likely to have it: raw Base32, otpauth:// URIs, a whole Google Authenticator export, or a QR code from the camera or an image.
* Explains broken lines instead of failing silently.
* Optionally remembers your secrets behind a passphrase — strictly opt-in, AES-256-GCM over PBKDF2-SHA-256 with 600,000 iterations, with an auto-lock. Without the vault, nothing is stored at all.
* Speaks 37 languages, all bundled, including right-to-left layouts.

The camera permission exists solely for the QR scanner and is declared optional hardware; importing a QR code from an image works without it. Auto-backup is disabled, so the encrypted vault never leaves the device.

The OTP algorithms are implemented from scratch against the RFC test vectors — no OTP library. The only borrowed crypto primitive is the Web Crypto API.

Important, independent of this app: set up backup codes with every provider before relying on any authenticator. They are the only thing that gets you back in when the secret is gone.

Build change only — the app itself is unchanged from 1.5.0. The Android build no longer needs the Capacitor CLI: a small script writes the six files the wrapper requires, byte for byte identical to what the CLI produced. That drops the hard Node 22 requirement, so Clockwork builds with the Node version a distribution ships. The Capacitor config moved from TypeScript to JSON for the same reason, and the empty Cordova bridge module is now checked in — it used to appear only when the CLI ran, so a