2FAuth 9 imports Ente Auth backups and sorts your one-time codes by favorites
Released October 27, 2026, 2FAuth 9 adds a table layout, a favorites system, and Ente Auth import to the self-hosted TOTP manager. If your codes live in a phone app, now is the time to move them out — but keep the container updated, as the October 22 PHP2Shell rebuild just proved.
October 27, 2026, 00:19 UTC. Bubka ships 2FAuth 9.0.0, a new major release of the self-hosted one-time password manager. October 22, 2026. Version 8.0.3 had already pushed an emergency Docker image with PHP 8.4.27 to patch the two PHP2Shell flaws. 9.0. The release adds a table layout, a favorites system, and Ente Auth import. The point that matters: you can finally organize your codes and leave a phone app behind without losing your backups — provided you remember that the server still has to be patched.
A vault that does not live in your pocket
2FAuth occupies a specific niche: it is a self-hosted TOTP and HOTP manager, distributed under AGPL-3.0, written in PHP on the Laravel framework, and shipped as a Docker image. Instead of trusting your codes to Google Authenticator or Authy, you store them in your own instance, reachable from any browser. The project has passed 4,000 stars on GitHub and positions itself as an alternative to proprietary authenticators, for individuals and teams alike.
Why care? A phone is a single point of failure: lose it, break it, or have it stolen, and you are locked out of every protected account at the worst possible moment. Moving the codes to a server you control buys you multi-device access, an encrypted backup, and the ability to share a specific account with a colleague without handing over the phone. The price is twofold: you have to host and maintain the service, and you have to accept concentrating every code in one place — which makes the security of that instance the whole game.
What version 9 changes
Version 9.0.0 is a comfort release more than a breaking one. The most visible addition is a table layout for desktop screens: instead of stacked cards, accounts render as rows and columns, which changes everything once you manage dozens of entries. Then comes the favorites system: a frequently used account can be marked as a favorite regardless of its group, and a toggle in the filter bar shows only those. For administration, new quick-select buttons make bulk operations easier — move, unshare, delete, or export several accounts in one pass.
Two fixes ship alongside the features. One resolves a bug where large API responses were truncated when the container ran as a non-root user, because the FastCGI temporary directory was not writable. The other clears an installation blocker caused by a Composer security advisory on the enshrined/svg-sanitize dependency. Both are the kind of fix that shows the project watches its dependencies closely — not a luxury for a security tool.
Ente Auth, the exit ramp
The most strategic change is support for the Ente Auth export format. Ente Auth is an open-source authenticator known for end-to-end encrypted backups; its export format has become something of a lingua franca for moving codes between managers. By accepting it on import, 2FAuth positions itself as the destination for anyone leaving Google Authenticator, Authy, or Ente Auth itself.
In practice, migration becomes: export your codes from the current app, import the file into 2FAuth, verify the codes rotate, then delete the old app. That is the complete loop many self-hosters were waiting for. Until now, importing codes into an instance often meant retyping every secret by hand — a discouraging exercise past twenty accounts. With Ente Auth, that barrier disappears, and the cost of switching to self-hosting drops in one move.
The PHP2Shell reminder: self-hosting makes you the patcher
Recent context gives this release extra weight. On October 22, 2026, 2FAuth shipped 8.0.3 with a single purpose: to push a Docker image bundling PHP 8.4.27, which fixed CVE-2026-109618 and CVE-2026-109619, the two PHP2Shell unauthenticated remote-code-execution flaws. Those vulnerabilities live in the PHP engine itself, have been present since version 5.4, and affect every PHP application — including a self-hosted code manager like 2FAuth.
The lesson is simple: when you self-host your authentication, you become your own patcher. A code manager sitting on an unpatched PHP2Shell flaw no longer protects anything; worse, it becomes the vault an attacker opens first. That is what separates serious self-hosters from the rest: tracking the project’s releases and pulling the image the moment a security fix is published. 2FAuth’s 8.0.3 is a good example of the right reaction — an updated image within hours of the PHP patch.
# Stay patched in two commands whenever a security fix lands:
docker compose pull 2fauth
docker compose up -d 2fauthShould you self-host your 2FA codes?
The answer is not binary. Self-hosting your TOTP codes removes the phone as a single point of failure and makes device migration trivial, but it moves the risk onto your own server: if the instance goes down or gets compromised, everything goes down at once. Cloud alternatives like Ente Auth or Bitwarden outsource maintenance to a third party but keep a central trust point. 2FAuth stands out for its simplicity: a SQLite or PostgreSQL database, a container, a web UI, and you are running.
The real selection criterion is operational discipline. A 2FAuth instance that is poorly backed up or never updated is more dangerous than a phone authenticator maintained by a vendor. Conversely, for a team that already patches its services and backs up its volumes, 2FAuth removes an intermediary and keeps the secrets under its own control — an argument that carries weight when authentication becomes the central lock on the whole infrastructure.
Verdict
If you manage more than twenty codes and want to leave a phone app, 2FAuth 9 is the moment to make the move: Ente Auth import removes the main barrier to migration, and favorites fix the day-to-day. If you are not ready to watch releases and rebuild the image on every security fix, stay on a cloud authenticator — the October 22 8.0.3 release is a reminder that a self-hosted manager is only as good as its updates. The underlying point has not changed: two-factor authentication protects as much as the discipline of whoever hosts it.