A dead-drop for your two-factor codes
A tiny, ephemeral relay that hands an encrypted account off from your phone to your watch — and forgets it existed within a minute.
Built for Huawei Watch · HarmonyOS
Yes, it's actually safe
The short version: this server never sees your account name, your secret key, or your codes. It only ever holds a locked box it can't open, for at most 60 seconds.
🔒 In plain words
Your phone locks your account data in a box before it ever leaves the phone. The box is sent here, your watch picks it up, and the watch is the only other device with the key to open it.
The box disappears the instant your watch grabs it — or after one minute, whichever happens first. Nothing is written to disk. Nothing is backed up. There is no database.
🛠️ In technical words
- Phone and watch each derive the same one-time key from your watch's device ID and a short sync code, via
HKDF-SHA256— the server never sees either input. - The payload is sealed with
AES-256-GCMbefore it's uploaded. This server stores only ciphertext, an IV, and an auth tag — opaque bytes it cannot decrypt. - Storage is in-memory only (
IMemoryCache), keyed by a derived lookup ID. TTL: 60 seconds, one-time read — a successful fetch deletes the entry immediately, TTL or not. - No logs, no persistence layer, no account database exists in this service at all — there is nothing to breach.
Five taps, end to end
Only one moment along this chain ever leaves your two devices — a sealed, unreadable box that lives on this relay for at most 60 seconds.
Add the account
Scan its QR code in the Companion app, or type the secret in by hand.
Point it at your watch
Scan the watch's QR code — or reuse an ID you already scanned before.
Get your one-time code
The app shows a short sync code right on your phone screen.
Type it into the watch
Enter that same code on the watch's on-screen keypad.
Codes appear on your watch
The watch fetches the account and starts generating codes right there.
Two small apps, one account
They're not the same app — one lives on your wrist, the other sets it up.
On your watch
Huawei Watch · HarmonyOS
The app that actually generates your codes — offline, once an account has been sent to it.
On your phone
Companion app · iOS & Android
How accounts get onto the watch in the first place — scan a QR code, type a secret in, or import from another authenticator.