Koder Pass is a comprehensive mobile identity companion with multi-factor authentication, encrypted vault, passkeys, biometrics, and SSO for the Koder ecosystem.
All vault data is end-to-end encrypted before leaving your device. The server stores only opaque ciphertext blobs.
Behavioral Analytics
Machine learning detects impossible travel, unusual times, new devices, and velocity anomalies in real-time.
FIDO2 / WebAuthn
Phishing-resistant passwordless authentication bound to the relying party origin. Cloned authenticator detection via sign count.
How We Compare
Koder Pass combines the best of authenticators, password managers, and identity platforms.
Feature
Koder Pass
Google Auth
1Password
Duo
Microsoft Auth
TOTP / HOTP
Yes
Yes
Yes
Yes
Yes
FIDO2 Passkeys
Yes
No
Yes
Yes
Yes
Push Authentication
Yes
No
No
Yes
Yes
QR Web Login
Yes
No
No
Yes
Yes
Encrypted Vault
Yes
No
Yes
No
No
Document Verification
Yes
No
No
No
No
Facial Biometrics + Liveness
Yes
No
No
No
No
NFC Chip Reading
Yes
No
No
No
No
Verifiable Credentials (W3C)
Yes
No
No
No
No
Mobile Driving License (mDL)
Yes
No
No
No
No
Device Trust Scoring
Yes
No
No
Yes
Partial
Conditional Access Policies
Yes
No
No
Yes
Yes
Behavioral Analytics
Yes
No
No
Yes
Partial
SSO Broker
Yes
No
No
No
Yes
Travel Mode
Yes
No
Yes
No
No
Emergency Access
Yes
No
Yes
No
No
Shared Vaults
Yes
No
Yes
No
No
Webhooks / API
Yes
No
Yes
Yes
Partial
Open Source
Yes
No
No
No
No
Self-Hosted
Yes
No
No
No
No
Frequently Asked Questions
Koder Pass combines the capabilities of an authenticator app (like Google Authenticator), a password manager (like 1Password), an identity verification platform (like Jumio), and an enterprise MFA provider (like Duo) into a single open-source, self-hosted solution. It includes features like document verification, NFC chip reading, W3C Verifiable Credentials, behavioral analytics, and conditional access policies that no single competitor offers.
Yes. All vault data is encrypted with AES-256-GCM before leaving your device. The encryption key is derived from your master password using PBKDF2-SHA256 with 600,000 iterations. The server only stores opaque ciphertext and cannot read your data. Sync between devices is also fully end-to-end encrypted.
Yes. The Go backend is a single binary with minimal dependencies (PostgreSQL and Redis). A Docker Compose setup is provided for easy deployment. You can run it on your own infrastructure with your own Koder ID instance for complete data sovereignty.
The Flutter app supports Android, iOS, macOS, Linux, Windows, and web. The primary target is mobile (Android and iOS) where biometric authentication and NFC chip reading are most relevant. The Go backend runs on any platform that Go supports.
When a service sends an authentication request, a push notification is delivered to your phone. You see the service name, IP address, location, and a number matching challenge. You must select the correct number (shown on the login screen) to approve the request. This prevents accidental approvals and push fatigue attacks.
Yes. Koder Pass is released under the MIT License. You can use, modify, and distribute it freely. The source code is available on Koder Flow.
Travel Mode lets you temporarily hide sensitive vaults when crossing borders. When enabled, selected vaults become invisible in the app. Only you can disable Travel Mode with your full authentication, ensuring that border agents or device inspections cannot see your hidden credentials.
