Status: in development, not yet released
There is no download here yet, and we would rather say so plainly than publish a button that does nothing. The application is written and under test; there is no signed public build. When there is one it will appear on the download page with checksums and a signature, and not a day earlier.
Why this exists
Steam Desktop Authenticator — SDA — is the tool most traders have used for years to keep Steam Guard on a PC instead of a phone. It works, and this project owes it the idea. But searching for it is dangerous: the name outranks its own source, and a long tail of lookalike sites offer "SDA download" builds that are simply account stealers. A maFile contains the shared secret for your authenticator. Hand it to the wrong binary once and the account is gone, along with everything in the inventory.
We think the answer is a tool where the dangerous parts are visible. Everything in this application that touches a secret is readable in the open, the builds are reproducible from that source, and the site tells you how to check that what you downloaded is what we published.
What it does
Steam Guard codes
The five-character code, regenerated every thirty seconds, with the time remaining shown as it drains. Copy puts it on the clipboard and clears it again on a timer.
Trade and market confirmations
Approve or cancel the confirmations Steam would otherwise send to a phone. Optional automatic confirmation is limited to market listings and trades, and cannot be widened to cover account-recovery requests.
Import from SDA
Reads .maFile accounts, including encrypted ones with their
manifest.json. Nothing is written to your vault until you
choose what to keep. How importing works.
An encrypted vault
Secrets are sealed with a key derived from your passphrase using scrypt, then encrypted with AES-256-GCM. The vault locks itself when you stop using it. The full security model.
Adding a new authenticator
Move Steam Guard onto this app for an account that does not have an authenticator yet, including the revocation code you must write down before anything is activated.
Recovery that exists in advance
A recovery file is written when an account is enrolled, not when you ask for one, and it survives removing the account — because that is exactly when people discover they need it.
What it will not do
A short list, because the things a security tool refuses to do are more informative than the things it offers.
- It does not send your secrets anywhere. There is no account to create, no server of ours to sync with, and no telemetry. The application talks to Steam and to nothing else.
- It does not update itself. It will tell you a newer version exists and link to it. An application that can silently replace its own executable is the exact mechanism the clone sites rely on.
- It does not auto-confirm anything dangerous. Automatic confirmation works from a fixed allowlist of two types. Account recovery is not on it and cannot be added by a setting.