DOCSEARCHbyAlgolia
Submit Docs

Tegata Documentation

website·Indexed 32 days ago

https://tegata.080f53.com

Tegata is an open-source portable authenticator that stores encrypted credentials on a standard USB drive or microSD card. It features a CLI, TUI, and desktop GUI, and is compatible with Windows 10+, macOS 12+, and Linux (amd64). The documentation covers vault management, credential workflows, and an optional audit layer using a hash-chained ScalarDL Ledger.

Tokens
12.7K
Snippets
85
Records
132
Agent score
49%

What's inside Tegata

  1. Overview of Tegata portable authenticator

    Tegata is an open-source portable authenticator that stores encrypted credentials on standard USB drives or microSD cards. It serves as a low-cost alternative to dedicated hardware security keys (like YubiKey) for users who require portability and physical control of their credentials without relying on phone-based apps or cloud accounts.

  2. Tegata User Interfaces

    Tegata provides two primary interfaces for managing credentials:

    1. Terminal UI (TUI): A guided CLI interface featuring a first-time setup wizard, a visual countdown timer for TOTP codes, full keyboard navigation, and viewport-aware context menus.
    2. Desktop GUI: A Wails + React application with full feature parity with the TUI, available for Windows, macOS, and Linux. It includes a vault identifier display to indicate which vault is currently open.

  3. Tegata Core Authenticator Features

    Tegata is an open-source portable authenticator that stores 2FA codes and credentials in an AES-256-GCM encrypted vault on standard USB or microSD cards. The core authenticator operates offline and provides the following capabilities:

    • TOTP/HOTP Generation: Supports RFC 6238/4226. TOTP supports SHA-1, SHA-256, and SHA-512; HOTP supports SHA-1.
    • Challenge-Response Signing: Signs challenge strings using HMAC-SHA256.
    • Static Password Storage: Stores credentials that do not use OTPs.
    • Vault Encryption: Uses AES-256-GCM with Argon2id passphrase stretching (time=3, memory=64 MiB, parallelism=4).
    • Security Measures: Includes a recovery key for lost passphrases, memguard-protected memory to zero key material after use, and an auto-lock feature that triggers after 5 minutes of idle time.
    • Management: Supports encrypted backup files for import/export and tag-based organization for filtering credentials.

  4. Understand Tegata's data privacy and network behavior

    Tegata operates entirely on the local device and does not collect telemetry or send analytics data. All authentication operations—including TOTP/HOTP code generation, challenge-response signing, and static password retrieval—are performed locally. Vault contents and passwords are never transmitted to external servers. The only exception is optional gRPC communication with a ScalarDL Ledger instance (configured by the user via Docker or a remote server). If audit logging is disabled, Tegata performs no network connections.

  5. Tegata privacy and data handling policy

    Tegata operates locally and does not send data to external servers, nor does it include telemetry, update checks, or analytics. The only network activity is optional gRPC communication between Tegata and a local ScalarDL Ledger instance running in Docker. If audit logging is disabled, there is no network activity.

  6. Tegata system requirements and platform support

    Tegata is supported on Windows 10+, macOS 12+, and Linux (amd64). The CLI and TUI are self-contained. The desktop GUI requires the platform's system WebView.

  7. Tegata GUI security and architecture limitations

    Developers and users should be aware of the following:

    • Memory Persistence: The vault passphrase is briefly held as an immutable JavaScript string in the WebView process. Due to non-deterministic garbage collection in V8, the passphrase may persist in the heap shortly after the Go backend zeroes its copy.
    • Native Dependencies: The GUI requires native builds for each platform because it relies on system WebViews (WebView2 on Windows, WKWebView on macOS, WebKit2GTK on Linux).

  8. Use Tegata across multiple computers and operating systems

    Tegata vaults are platform-independent and reside on the USB drive rather than the host machine. You can unlock the same vault file on Windows, macOS, and Linux without conversion. Because the CLI binary can also be stored on the USB drive, Tegata can be run on any machine without local installation.

  9. Understand Tegata credential storage and encryption

    Tegata stores encrypted credential vaults on standard USB drives or microSD cards, removing the need for cloud accounts or sync services. Credentials are encrypted using AES-256-GCM with a user-defined passphrase. All authentication processes occur locally on the hardware device to ensure data privacy.

  10. Add credentials to a Tegata vault

    Tegata supports adding credentials via manual entry or by scanning an otpauth:// URI. Scanning is recommended as it automatically parses the issuer, algorithm, digits, and period.
    # Replace /path/to/vault with your actual vault path
tegata add GitHub --scan --vault /path/to/vault

  11. Create a new Tegata vault using the Setup Wizard

    On first launch, select Create new vault to start the setup wizard. The process involves:

    1. Vault Location: Select a directory on a USB drive or microSD card.
    2. Passphrase: Create and confirm a secure passphrase.
    3. Recovery Key: Save the recovery key immediately; it is displayed only once and is required if the passphrase is lost.
    4. First Credential: Optionally add a credential or skip this step.

  12. Change the Tegata vault passphrase

    You can change your vault passphrase via the CLI or the GUI (File → Change passphrase). This operation re-wraps the data encryption key without re-encrypting the entire credential payload, ensuring the process is fast regardless of vault size.
    tegata change-passphrase