andcli lets you work with 2FA tokens directly in your shell, using encrypted backups exported out of your favourite 2FA apps. All the data is held in memory only and will never leave your machine.
andcli can handle input from the following providers:
At the moment only TOTP entries are supported.
Download a prebuild release and place it somewhere in your $PATH. If you have Go installed you can install directly: go install -ldflags='-s -w' github.com/tjblackheart/andcli/v2/cmd/andcli@latest.
- Export an encrypted, password protected backup from your app and save it into your preferred cloud provider (i.e. Dropbox, Nextcloud...).
- Start
andcliand point it to this file withandcli <path/to/file>. Specify the vault type via-t <type>. The path and type will be persisted, so you have to do this only once. - Enter the password.
- To search for an entry, type
/. - Navigate via keyboard, press
Enterto view a token and presscto copy it into the clipboard. Pressuto hide usernames for this entry, which are visible by default.
↑/k up
↓/j down
/ filter
enter show/hide token
u show/hide usernames
c copy
q quit
By default andcli will choose the first system clipboard tool found. For Linux, this could be either xclip, xsel or wl-copy. For Mac, it will always be pbcopy, and for a Windows machine it defaults to clip.exe. If you need more control over this command, you can either edit the config file and set your preferred command including all flags in the clipboard_cmd entry, or you could pass the full command via the -c flag.
The configuration will get persisted in the default user home config directory. For Linux, this is $HOME/.config/andcli. For MacOS, it's $HOME/Library/Application Support/andcli and for Windows it should be in C:\Users\$USER\AppData\Roaming\andcli.
Usage: andcli [flags] <path/to/file>
Flags:
-f, --file string Path to the encrypted vault (deprecated: Pass the filename directly)
-t, --type string Vault type (andotp, aegis, twofas, stratum)
-c, --clipboard-cmd string A custom clipboard command, including args (xclip, wl-copy, pbcopy etc.)
-v, --version Prints version info and exits
-h, --help Show this help
A usable vault implementation for andcli has to implement an interface providing only one function called Entries(). Have a look at the current implementations to see how this works.
You can use the demo registration server implementation at tools/srv to quickly create some demo tokens for your vault.
