ISH Authenticator

YOUR CODES. YOUR DEVICE.

A little more secure.

A separate, local authenticator for your ISH sign-in.

Open your vault.

Choose a unique passphrase of at least 16 characters—not your ISH password. There is no master bypass or passphrase reset. Keep an encrypted backup and store its passphrase separately.

Restore an encrypted backup

Restoring replaces this browser’s existing vault after confirmation. A backup cannot be recovered without its passphrase.

Security & recovery

This app does not sign in to ISH or grant permissions. It stores your authenticator secrets in an encrypted vault in this browser. It has no cloud sync, analytics, master key, account-recovery service or password reset.

Keep the vault passphrase outside this app. An encrypted backup plus its passphrase restores the codes on another supported device. Without those, a lost vault requires recovery with each account provider or your ISH administrator.

Encryption does not protect secrets while malicious code is running in an unlocked app. This is a pilot implementation, not an independently audited native authenticator. Home-screen installation does not give it hardware-backed storage. It locks when hidden and after two minutes without interaction.

For ISH setup: open your staff-security page, generate a setup key, enter it here, then enter this app’s current code back on the security page. Deleting an account here does not remove its MFA factor at Supabase.

Add an authenticator.

Manual keys default to SHA-1, 6 digits, 30 seconds (ISH/Supabase). A full TOTP URI may specify SHA-256/SHA-512, 8 digits or a 60-second period.

Change vault passphrase.