Case study · Plugin

Flutter MFA

Flutter MFA is an open-source multi-factor authentication toolkit for Flutter and Dart: RFC-compliant TOTP/HOTP, secrets kept in hardware-backed platform vaults (Android Keystore, iOS Keychain, WebCrypto) with optional biometric binding, encrypted backups, accessible MFA widgets and a pure-Dart verifier for your server. Five packages, published on pub.dev under the verified breaktroughf1.com publisher.

View on pub.dev Source on GitHub API docs

Security
Flutter
Dart
Authentication
Open source

All projects

Current version: 0.2.1

Project / 02Plugin

Client: Open source · with ARDC, CHRIST University
Industry: Developer tools · Security
Year: 2026
Duration: Ongoing · v0.2
Services: SDK designSecurity engineeringAndroid, iOS & Web pluginsAccessible UIDocumentation

The challenge

Adding an authenticator or two-factor sign-in to a Flutter app meant combining packages with different security models, storing OTP secrets in places that weren't built for them, and writing separate code to check codes on the server.

Our approach

01
One audited core, used on both sides
flutter_mfa_core is pure Dart: TOTP/HOTP to RFC 6238 and 4226, otpauth URIs and encrypted backups, plus a server verifier with replay protection and attempt limiting. The same code runs in the app and on the server.
02
Secrets in the platform's own vault
Seeds are encrypted under non-exportable keys in Android Keystore (StrongBox where present), the iOS Keychain or Secure Enclave, and WebCrypto, are excluded from backups, and can be bound to biometrics so no code is produced without a fresh biometric check.
03
Small packages, built in the open
Five packages (core, plugin, platform interface, accessible widgets with Hindi/Arabic translations, optional QR scanner), so apps take only what they need. Threat model, ADRs, cookbook guides and an example app live in the repository, and releases ship from GitHub Actions.

The outcome

In November 2026 we published all five packages on pub.dev under the verified breaktroughf1.com publisher, MIT licensed. Each package scores 150 to 160 of 160 pub points, and they support Android, iOS and the web, with the core also running on Dart servers. The packages make no network requests and collect no telemetry.

Packages on pub.dev: 5
pub points, flutter_mfa: 160/160
Network requests or telemetry: 0

Technical details

Under the hood.

Key features

TOTP and HOTP codes (RFC 6238 / RFC 4226) with otpauth:// enrolment
Secrets in Android Keystore (StrongBox), iOS Keychain (Secure Enclave) and non-extractable WebCrypto keys
Optional biometric-bound protection: no code without a fresh biometric check
Server-side verification with replay protection and attempt limiting
Encrypted backup export and import (AES-256-GCM, PBKDF2)
Accessible, design-system independent widgets with Hindi and Arabic translations
No network requests and no telemetry