Data storage

Structure

Data is stored in a file format file called "wfs", short for WristkeyFS, modelled after the KeyspaceFS file structure. It consists of a JSON object that contains items in an array with a key called "otpauth" for 2FA codes.

{
    "otpauth": [
        "otpauth://totp/Google%20LLC%2E:me%400x4f.in?secret=ASDFGHJKL&issuer=Google&algorithm=SHA1&digits=6&period=30&counter=0&label=Personal",
        "otpauth://hotp/GitHub%20Inc%2E:me%400x4f.in?secret=QWERTYUIOP&issuer=GitHub&algorithm=SHA1&digits=6&counter=10&label=Personal"
    ]
}

This JSON is escaped, base64'd and encrypted locally with your device MasterKey, which in turn uses AES. It is also transmitted in an encrypted base64 form (but with a separate X25519 keypair).

2FA Codes

Wristkey's 2FA codes simply store data in an otpauth:// URL, as displayed in the QR codes you scan. This reduces complexity and makes exports and management easier. To learn more about this protocol visit the official Google Authenticator spec docs.