Google Authenticator uses an open time-based algorithm that doesn't even require a server. Both sides just need to have the same seed and the same time on their

Google Authenticator uses an open time-based algorithm that doesn't even require a server. Both sides just need to have the same seed and the same time on their clock (you can configure server-side how much clock drift to allow). Authy supports the algorithm as well, they just don't advertise it because they want you to use their's. It's actually an RFC https://tools.ietf.org/html/rfc6238 https://tools.ietf.org/html/rfc6238 and there are implementations for almost any language.