- Need a vault that is encrypted before sending to server - all encryption/decryption occurs on user device - have ai check for best encryption, likely sha256 - use pin + random key on device to unlock/lock - Once vault is made then move the 2fa to vault - add good auth like features - factiii 2fa always on top - other 2fas can go below - be able to steal google 2fa from google auth - add ability to download/upload vault - make it so user can choose if vault goes to server or not and explain encryption - quick explainer if factiii server unreachable that it still shows in the 503 page with a faceid - this will replace the entire 2fa we have, but make sure to allow faceid to unlock