We run no servers, hold no accounts and receive none of your data. This page says exactly where everything is stored and what, if anything, leaves your device.
Effective 1 August 2026
Nothing. The extension has no backend. There is no account to create, no login, no analytics, no crash reporting and no telemetry of any kind. We never see your accounts, your secret keys, the codes they generate, or which services you use them with.
This website sets no cookies and runs no analytics or tracking scripts.
Everything the extension knows lives in your own browser. There are four places, and it is worth being precise about each:
| Where | What | Leaves your device? |
|---|---|---|
| Browser local storage | Your accounts and settings. Encrypted if you turn on password protection. | No |
| Browser session memory | The key that unlocks your codes, while the vault is unlocked. Never written to disk; cleared when the browser closes. | No |
| Chrome Sync (optional) | A copy of your accounts, so they appear in your other Chrome browsers. | Yes — to Google, under your account |
| IndexedDB | Seven rolling daily snapshots, so a mistake does not cost you your accounts. | No |
Worth understanding about Chrome Sync. It is a Chrome feature, not ours: the data is replicated through your own Google account, and we never receive it. But with password protection off, your accounts are stored there unencrypted, which means Google holds them. Turning on password protection encrypts them before they are ever handed to sync. Turning sync off in Settings stops the replication and removes what is already there.
When the popup is open, the extension reads the address of your active tab so it can highlight the matching account, and it remembers which account you use on which site to get better at guessing. This never leaves your device and is not covered by the password vault while it is being collected.
You can switch this off under Suggest account for this site in Settings, which also erases everything it had remembered. Turning on password protection deletes it too.
The extension cannot read the content of pages you visit. It has no content scripts and no host permissions.
If you scan a QR code with your camera, the video is processed entirely in your browser and is never recorded, uploaded or transmitted. Your browser asks for permission the first time, and only when you open the scanner — the extension does not request camera access at install time, and you can revoke it in your browser's site settings.
The extension makes no automatic requests during normal use. These are the only connections it can make:
Nothing else. No fonts, scripts or images are loaded from anyone else's servers — everything needed to draw the interface ships inside the extension.
Removing the extension deletes everything it stored on your device, including the backups.
If you used Chrome Sync, the copy held under your Google account is removed by turning sync off in Settings beforeuninstalling. You can also clear it from Chrome's own sync settings.
Since we hold nothing, there is nothing to request from us and nothing for us to delete on your behalf.
The extension is not directed at children and collects no personal information from anyone, of any age.
If this policy changes in a way that affects what is stored or what leaves your device, we will update the effective date above and note the change in the extension's release notes.
Questions about privacy or anything else: support. For vulnerability reports use security@authenticator.sh instead — see the security policy.
The extension is open source — you do not have to take any of this on trust. Read it at github.com/authenticator-sh/2fa, and see our security policy for how to report a vulnerability.