Passkeys & OTP Without Cloud for Private Authentication | My Passwords

Passwords have a familiar weakness: people have to remember them, reuse them, type them into websites, and hope no one tricks them into giving them away. Attackers know this, which is why phishing pages, credential stuffing, and leaked password lists remain such common threats.

Passkeys and one-time passwords, often called OTPs, give users a better way to prove who they are. Even better, they do not have to depend on cloud storage to be useful. With the right local-first setup, authentication can stay secure, private, and fully under the user’s control.

My Passwords is offline and supports passkeys and OTPs, making it a practical option for people who want modern authentication without handing their most sensitive login tools to a cloud account.

Passkeys and OTPs solve different authentication problems

A passkey is a newer type of login credential based on public key cryptography. Instead of creating and typing a password, the device creates a matched pair of cryptographic keys.

One key is public. The website or app stores it.

The other key is private. The user’s device stores it and never shares it.

When a user signs in, the service sends a challenge to the device. The device proves it has the private key by signing that challenge. The service checks the signature with the public key. If it matches, the user gets in.

That matters because there is no password to steal from the website, no secret to type into a fake page, and no reusable text string for attackers to try elsewhere.

An OTP, or one-time password, is a temporary code used to confirm a login. Most people know OTPs as six-digit codes generated by an authenticator app or sent by text message. The stronger local version is usually generated on the device through a standard such as TOTP, or time-based one-time password.

With TOTP, the service and the authenticator app both know the same secret value. The app combines that secret with the current time to generate a short code, usually refreshed every 30 seconds. The user enters the code during login, and the service checks whether it matches.

Passkeys and OTPs are not the same tool:

Authentication method	What it does best	Common user action
Passkey	Replaces the password with cryptographic proof	Approve with device unlock, biometrics, PIN, or security key
OTP	Adds a second factor to a password or login flow	Enter a short temporary code
Password	Acts as a shared secret	Type or paste a reusable secret

Passkeys aim to remove the password problem. OTPs help reduce the damage if a password is exposed. Used well, both can raise the security bar.

Offline authentication does not mean disconnected from reality

The phrase “offline passkeys and OTPs” can sound confusing at first. After all, logging in to a website still involves the internet. The “offline” part refers to where the sensitive authentication material is stored and managed.

With a cloud-based password manager or authenticator, encrypted data may sync through remote servers. That can be convenient, especially across many devices. But it also adds dependency. If the cloud account is compromised, unavailable, locked, or targeted by phishing, the user’s authentication tools may be at risk or out of reach.

A local-first setup keeps the most sensitive data on the user’s device. That includes:

• Private keys for passkeys

• OTP shared secrets

• Recovery codes

• Login records

• Notes tied to accounts

  
  

For passkeys, offline storage means the private key stays local. The website only receives and stores the public key. When the user signs in, the device signs a challenge locally. The private key does not travel through a server, email inbox, browser sync account, or cloud vault.

For OTPs, offline storage means the OTP seed, sometimes shown as a QR code during setup, stays in the local authenticator database. The app can generate codes without an internet connection because the math only needs two things: the stored secret and the current time.

That is why OTP apps can still show codes in airplane mode. They are not asking a server for the code. They are calculating it locally.

Local storage improves privacy as well as security

Security and privacy often overlap, but they are not identical. Security asks whether attackers can break in. Privacy asks who can see, store, analyze, or connect personal activity.

Cloud authentication tools can be safe when designed well, but they still involve remote infrastructure. Metadata may exist. Account recovery flows may create weak points. Sync accounts can become high-value targets. Users also have to trust that the service will keep working as promised.

A local solution reduces that exposure.

With local passkeys and OTPs, the authentication secrets stay closer to the person who owns them. There is less data moving through third-party systems, fewer remote accounts involved in sign-in, and fewer chances for sensitive vault data to appear where it was never needed.

This has practical privacy benefits:

• Fewer authentication secrets stored on remote servers

• Less reliance on centralized sync accounts

• Lower exposure if a cloud provider has an outage

• More control over backups and device access

• Reduced risk from remote account takeover

  
  

The privacy gain is especially clear with OTP seeds. If an attacker gets the seed, they can generate the same codes as the user. Keeping that seed local and protected by device encryption, app lock, and secure backups helps limit the number of places it can be stolen from.

Passkeys also limit what websites can misuse. A public key is not a password. It cannot be used to sign in at another site, and it does not reveal the private key. Many passkey systems are also phishing-resistant because the credential is tied to the real website or app origin. A fake site cannot usually use a passkey created for the real one.

That makes passkeys strong against one of the oldest attacks on the internet: tricking people into typing secrets into the wrong place.

How My Passwords fits a local-first authentication model

My Passwords is offline and supports passkeys and OTPs, which makes it useful for people who want authentication tools without depending on cloud storage.

That local-first approach changes the trust model. Instead of placing the center of security in a remote account, the user keeps the key material on their own device. The app becomes the place where passkeys, OTPs, and related login details are managed privately.

A local app can also help keep different authentication pieces organized. For example, an account might have:

• A passkey for passwordless sign-in

• An OTP code as a backup second factor

• Recovery codes saved securely

• Notes about which device holds the credential

• The date the authentication method was enabled

  
  

This matters because security is not only about strong technology. It is also about being able to find and use that technology when something goes wrong.

A person who loses track of recovery codes may be locked out. A person who stores OTP seeds in screenshots may weaken their own second factor. A person who syncs every secret everywhere may increase risk without realizing it.

A private, offline manager encourages a cleaner pattern: keep sensitive login material in one protected local place, back it up carefully, and avoid scattering it across photos, emails, messages, and notes.

Real-world uses for passkeys and OTPs

Passkeys and OTPs are already useful in everyday accounts. The exact availability depends on the website or app, but the pattern is becoming more common.

Personal email accounts

Email is often the recovery hub for everything else. If someone controls an email account, they can reset many other passwords.

A strong setup might use a passkey as the primary sign-in method and keep OTP or recovery codes as a fallback. If the provider allows it, removing weaker recovery methods can also help.

Banking and financial apps

Financial services often use layered authentication. Some use app-based approvals, some support passkeys, and many use one-time codes.

Where available, passkeys can reduce phishing risk. OTPs can still help as an added check, especially when paired with alerts and device-based approval.

Work and school accounts

Many organizations use single sign-on, authenticator apps, security keys, or platform passkeys. A local-first tool can help users keep track of which accounts use which methods, while still following the rules set by the organization.

For managed accounts, the organization’s policy always matters. Some accounts may require approved authenticators or managed devices.

Developer and admin access

Developers, system administrators, and power users often protect higher-risk accounts such as code repositories, domain registrars, server dashboards, and hosting services.

These accounts are valuable targets. Passkeys or hardware-backed credentials can help prevent phishing. OTPs and recovery codes need careful storage because losing access can cause serious disruption.

Family and household accounts

Authentication is not only for technical users. Streaming accounts, school portals, shared devices, health portals, and home network accounts all benefit from better login habits.

A local app can help households avoid weak shared passwords and keep recovery information in a known place without putting it into a shared cloud document.

Local authentication has tradeoffs users should understand

Offline storage brings control, but control comes with responsibility.

If a cloud service syncs credentials, a lost phone may not be a disaster because the user can restore access from another signed-in device. With a fully local method, backup planning becomes essential.

That does not make local storage worse. It makes the backup process more deliberate.

The main tradeoffs are clear:

Benefit	Responsibility
Secrets stay local	The user must protect the device
Less cloud dependency	The user must create safe backups
Better privacy control	The user must manage recovery carefully
Lower remote exposure	The user must avoid losing the only copy

A good local setup should never mean “one device, no backup, hope for the best.” It should mean “local by default, backed up in a secure and intentional way.”

Tips for setting up passkeys and OTPs securely

The safest authentication setup is the one that is strong, understandable, and recoverable. Use these habits when implementing passkeys and OTPs without relying on cloud services.

Protect the device first

Local authentication depends on the device being secure. Use a strong screen lock, such as a long PIN, passphrase, or biometric unlock backed by a device passcode.

Keep the operating system updated. Security updates fix weaknesses that attackers may use to access local data.

Use passkeys where they are available

When a site supports passkeys, consider enabling them, especially for important accounts. Passkeys reduce the need to type passwords and make phishing much harder.

Keep at least one recovery method available until you are confident the passkey works across your normal login situations.

Prefer app-based OTP over SMS when possible

SMS codes are better than no second factor, but they have known weaknesses. Phone numbers can be transferred, intercepted, or targeted through social engineering.

An offline authenticator that stores OTP seeds locally is usually a stronger choice than text messages.

Save recovery codes safely

Many services provide recovery codes when enabling two-factor authentication. Treat them like spare house keys.

Do not leave them in your camera roll, email inbox, or chat history. Store them in an encrypted local vault, print them and lock them away, or use both methods if the account is critical.

Back up local data before you need it

A local-first setup needs a backup plan. Export encrypted backups when the app supports it, and store them somewhere safe.

Good backup habits include:

• Keep at least one backup outside the main device

• Encrypt backups before storing them

• Test recovery before an emergency

• Update backups after adding important accounts

• Keep backup passwords separate from the backup file

  
  

Avoid mixing secrets with screenshots

QR codes used for OTP setup contain the shared secret. A screenshot of that QR code can allow someone else to generate your OTP codes.

After setup, delete setup screenshots if you created any. Better yet, avoid taking them in the first place.

Review old accounts

Authentication settings change over time. An account that only supported SMS two years ago may support passkeys now.

Review important accounts every few months. Look for stronger sign-in options, remove unused devices, and update recovery information.

The best authentication is strong, private, and recoverable

Passkeys and OTPs both improve account security, but they do it in different ways. Passkeys replace passwords with cryptographic proof that is hard to phish. OTPs add temporary codes that reduce the harm of a stolen password.

When these tools work without cloud storage, they also support stronger privacy. Private keys, OTP seeds, recovery codes, and login details can stay on the user’s device instead of spreading across remote systems.

The key is balance. Local authentication gives more control, but it also requires careful backups, strong device protection, and good recovery habits.

For anyone who wants secure private authentication without relying on cloud services, an offline tool like My Passwords can bring passkeys and OTPs together in one local place. That keeps modern login protection practical, private, and ready when it matters.