Nthly: A Deep Dive into the Privacy-First 2FA Authenticator with Zero Cloud Dependencies

When Two-Factor Authentication Meets Privacy Anxiety

In an era of frequent password breaches, two-factor authentication (2FA) has long evolved from an optional feature to a necessity. Two-factor authentication is a multi-factor identity verification mechanism that requires users to provide a second, independent form of identification (second factor: something you have or a biometric trait) beyond entering a password (first factor: something you know). This concept originates from the "defense in depth" philosophy in information security — even if an attacker obtains a password through phishing, database leaks, or brute-force attacks, they still cannot log in without the second factor. According to Verizon's 2023 Data Breach Investigations Report, over 80% of hacking incidents are related to credential compromise, which has driven 2FA from an enterprise security standard down to a basic protective measure for everyday users.

However, most mainstream authenticator apps on the market rely on cloud syncing — your keys are uploaded to third-party servers, and while you enjoy the convenience, you're also planting potential risks. When authenticator apps sync keys to the cloud, they actually introduce multiple additional attack vectors: the cloud provider's servers could be compromised (as in the 2022 LastPass incident where encrypted vault data was stolen), a user's cloud account itself could be taken over due to weak passwords or social engineering attacks, there's the risk of man-in-the-middle attacks during transmission, and the potential for improper access by the provider's internal staff. This model is referred to in cryptography as "trust chain extension" — you no longer only need to trust your own device's security, but also need to trust the third party's encryption implementation, key management policies, employee conduct standards, and their response to government data requests.

Recently launched on Product Hunt, Nthly directly addresses this pain point as a privacy-first 2FA authenticator for iOS.

According to its Product Hunt page, Nthly was built by developer Líkið Geimfari. On its launch day, it received 8 upvotes and 4 comments, ranking 17th on that day's leaderboard, and was categorized under Productivity, Developer Tools, and Security. While the numbers are modest, its design philosophy is well worth discussing in today's landscape.

Nthly's Core Value Proposition: Keys Never Leave Your Device

Nthly's clearest positioning is "no accounts, no third-party servers." According to its official description, it requires no account registration and never uploads your secrets to any cloud — all sensitive information remains locally on your iPhone.

Implementing purely local key storage on iOS typically relies on Apple's Keychain Services and the Secure Enclave hardware security module. The Secure Enclave is an independent coprocessor with its own cryptographic engine and secure boot chain — even if the main processor is compromised, keys stored within it cannot be extracted. Keychain provides app-level encrypted storage where data is automatically encrypted when the device is locked, with strict isolation between different apps. For a purely local authenticator like Nthly, fully leveraging these hardware-level security capabilities means that key security is essentially tied to the physical security of the device.

This stands in stark contrast to mainstream 2FA solutions like Google Authenticator and Authy. While these offer the convenience of cross-device syncing, they fundamentally require users to trust their cloud infrastructure. Nthly's approach is different: it shrinks the trust boundary down to the device itself. For security-conscious users, developers, and professionals handling sensitive accounts, this "zero third-party trust" model is clearly more appealing.

TOTP and HOTP Standard Protocol Support Ensures Compatibility

On the technical implementation side, Nthly supports the industry-standard TOTP (Time-based One-Time Password) and HOTP (HMAC-based One-Time Password) protocols.

TOTP is defined in RFC 6238. It works by combining a shared secret with the current timestamp (typically using a 30-second step) through HMAC-SHA1/SHA256/SHA512 algorithms to generate a 6-8 digit code. Both server and client independently perform the calculation, and as long as their clocks are synchronized (typically allowing a tolerance of one time window before and after), both sides arrive at the same verification code. HOTP, defined in RFC 4226, replaces the timestamp with an incrementing counter as the variable, with the counter increasing by one after each successful verification. Because TOTP has a time-window auto-expiry feature, it offers slightly better security than HOTP and is the standard adopted by the vast majority of internet services today. Both protocols were promoted by the OATH (Initiative for Open Authentication) organization and are fully open industry standards.

This means Nthly is compatible with the vast majority of services that support two-factor authentication, including Google, GitHub, bank accounts, and hundreds of other platforms with various enterprise accounts. Adhering to open standards is the baseline for tools like this. It ensures users won't be locked into a single application — if they want to migrate to another authenticator in the future, as long as it also supports TOTP/HOTP, the transition should theoretically be seamless.

The Classic Trade-off Between Privacy and Convenience

Nthly's product philosophy is fundamentally a deliberate trade-off between privacy and security versus convenience. This philosophy is closely related to the recently emerging concepts of "Data Sovereignty" and "Zero Trust Architecture." Data Sovereignty emphasizes that data owners should have complete control over where their data is stored and how it is accessed. This concept originally stemmed from national-level data governance (such as GDPR's data localization requirements) but is now valued by individual users as well. The Zero Trust model, proposed by Forrester Research in 2010, is built on the core principle of "never trust, always verify" — data should not be assumed safe simply because it resides within a "trusted" network or server. Applying both of these concepts to 2FA tool design yields Nthly's product philosophy: assume no third party is trustworthy, and strictly confine the trust boundary to hardware devices under the user's own control.

Choosing not to rely on the cloud means users gain stronger privacy protection and a smaller attack surface. But the flip side is: if a phone is lost or damaged, how can locally stored keys be recovered? This is a problem every purely local solution must face.

Traditionally, purely local 2FA apps typically offer several backup approaches: first, having users manually record recovery codes (usually 8-16 single-use static codes) when initially setting up 2FA; second, supporting export of keys in an encrypted file format that users can store on offline media like USB drives or paper printouts; third, leveraging the operating system's encrypted backup features (such as iOS encrypted iTunes/Finder backups, which include Keychain data). Industry-leading products like the open-source Aegis Authenticator (Android) allow users to set a master password and export encrypted JSON backup files. It's worth noting that iCloud backups do not include Keychain items marked as "this device only" by default — a technical detail that purely local solutions on iOS need to specifically address.

For Nthly, its specific backup and recovery mechanism will directly determine the product's practical ceiling — publicly available information currently says little about this.

Nthly's Target User Profile

Based on its category tags (Security, Developer Tools) and product positioning, Nthly isn't targeting mainstream users who want "one-click sync and seamless multi-device" experiences. Instead, it's aimed at technically-oriented users who prioritize data sovereignty:

• Developers and engineers: Those who routinely manage numerous sensitive accounts across GitHub, cloud services, and more;
• Privacy-conscious users: Those who approach third-party servers with caution and are willing to sacrifice some convenience for control;
• Security professionals: Specialists who treat "minimizing the attack surface" as a fundamental principle.

Conclusion: A Privacy-First 2FA Tool Worth Watching

In the seemingly mature 2FA authenticator space, Nthly carves out a niche with its "local-first, cloud-free" differentiation, responding to growing user concerns about data privacy. It's not trying to replace full-featured mainstream apps but rather offers a purer option for a specific audience.

As a newly launched product, Nthly currently has a very limited user base and validation. Its experience around cross-device scenarios and key backup still awaits market testing. However, the "privacy-first" approach it represents is undeniably a commendable direction in the evolution of security tools. For iPhone users willing to invest a bit more operational effort for privacy, Nthly is worth a try.