Privacy Policy

2FA Authenticator is published by Kobaltstack LLC, 447 Broadway, 2nd Floor, 3436, New York, NY 10013, US. We are responsible for (the "controller" of) the personal data this policy describes. For anything in it, write to support@authenticator.sh.

Never: your secret keys, your account names or issuers, the codes they generate, or the sites you use them on. There is no account to create and no login, and there is no crash reporting.

The daily check-in

Once a day — when the browser starts, or after the popup has opened, never on the way to showing a code — the extension sends our server, api.authenticator.sh, these fields and nothing else:

• a random id created by this installation (the install id). It is not linked to your Google account, your email address or your browser — unless you buy Pro: then the purchase record links the installation you bought from, and any installation where your license key is active, to the email address you paid with;
• the extension's version, its interface language and your browser's language;
• when the installation appeared, and whether it predates version 1.14.0;
• how many accounts it holds — a number, never which ones;
• whether password protection and sync are on, and whether it opens as a popup, a window or the side panel;
• which free-plan policy and license it currently holds, whether it already has its license key, and the last four characters of that key;
• how many times the extension was opened on each day since the last check-in — a count per day, nothing about what was looked at;
• billing events from a closed list: the free limit was approached or reached (and whether you were adding by hand, by QR code or from a file), the Pro screen was shown or closed and after how long, a plan was chosen, a checkout was opened, part of an import was taken for free, a license key was entered or a lost one requested, the Pro settings were opened.

Our server records the country the request came from, which our host works out from your IP address. The IP address itself is not stored: to limit how often requests can be made, the server counts them under a salted hash of it, and those counters are deleted within two days. The server answers with a signed policy — whether this installation has an account limit, and how high it is — and, if the installation holds one, a signed license. To the installation you bought Pro on, and only until it reports that it has it, the answer also carries your license key, so Pro can reach your other Chrome profiles without you typing it (see Chrome Sync below). An installation where you typed the key in is never sent one.

We use this to decide whether the free plan's account limit applies to an installation, to deliver and check Pro, to keep the service from being abused, and to understand how the free plan and Pro are used so we can improve them — for example, how many accounts people keep, which is how the limit is chosen, and whether a change makes people uninstall.

If you buy Pro

Payment happens on Stripe Checkout, in a new tab. Link, Stripe's payment service, is the merchant of record: it takes your payment details, issues receipts, handles taxes and answers questions about an order, under its own privacy policy. Your card details never reach us. With the checkout, Stripe receives the install id you bought from, the plan, and which policy and offer led to it, so the purchase can be matched to your installation, and keeps the install id with the purchase; the checkout opens in the extension's language.

From Stripe we receive the email address you paid with, the country of your billing address, and the purchase details — plan, amount, currency, tax, the status of the payment and subscription, and Stripe's ids for them. We use these to issue your license key (2FA-XXXXX-XXXXX-XXXXX-XXXXX), email it to you, send it again if you ask, and let you manage your subscription. The key is stored as a hash, plus an encrypted copy so it can be sent again. A license works on up to five installations: we record which installations it is active on and when each last checked in, and one that has not checked in for 60 days frees its place. When the payment has gone through, the page Stripe sends you back to on this site asks our server for the result, using the checkout id in its address. For the first three days after the purchase it shows your key and a masked version of your email address; after that it shows only that masked address, where the key was sent. What Pro includes is on the Pro page.

When you uninstall

When you remove the extension, your browser opens our uninstall pagewith the install id in its address. As it opens, the page tells our server, with the install id and nothing else, that the installation was removed; our server marks it as uninstalled. The page then asks one question: why. Picking a reason sends that reason, with the install id, to our server, which records it. The same reason — without the install id — goes on to a Google Form, together with whatever you type in the box under it, an address if you want a reply, the page's language, and a random id made for that page view so a reason and the text typed after it read as one answer.

Your browser never contacts Google: the page posts to our own website, whose server forwards the answer, so no cookie of theirs is set and nothing else about you — your address, your browser, the page you came from — travels with it. Answering is entirely optional, and closing the tab sends nothing at all.

This website

This website runs no analytics or tracking scripts, and loads nothing from Meta, Google Analytics or any other ad network. It sets advertising cookies only for people who arrive through one of our ads, as described below. If you pick a language in the language selector, a cookie remembers that choice; a notice you close is remembered in your browser's local storage. Neither is sent anywhere else. The site's typeface is served from our own server, not from Google Fonts. Two things come from elsewhere: the footer shows Product Hunt's badge, loaded from Product Hunt's server without telling it which page you were on, and the feedback page at /rate embeds a Google Form, which your browser loads from Google when you open that page. Like any website, ours keeps ordinary request logs (IP address, browser version, time) at our host.

The code generator page asks this site for one thing: the current time, so it can tell you when your device clock has drifted far enough to have your codes refused. It is requested only once you have entered a secret, and the secret is never part of it — the code is computed in your browser and the secret never leaves the tab. The request carries no cookie and no referrer; like every other request to this site it reaches ordinary request logs (IP address, browser version, time) and nothing else. If it fails, the page falls back to your device clock and keeps working.

Our ads

We advertise the extension on Facebook and Instagram. Those ads link to an address on this site (/go) that sends you straight on to the Chrome Web Store. On the way through, our server sets three cookies on this domain, for 90 days: _fbc, the click identifier Meta added to the ad's link; _fbp, a random browser identifier; and _attr, which campaign and ad you clicked. They can be read only by our server, not by scripts on the page. Visitors from the European Economic Area, the United Kingdom and Switzerland get none of them.

If you then install the extension, the welcome page it opens tells our server so. When those cookies are present, our server records the install — the three cookies, your browser version, country and the time — and sends Meta Platforms the click and browser identifiers, your IP address and browser version, so that Meta can tell which ad led to an install. Your IP address is passed on and not stored. Without those cookies — that is, for everyone who did not come from one of our ads — nothing is recorded or sent. Nothing about the extension itself, your accounts or your codes is ever part of it. You can delete the cookies in your browser at any time; what Meta does with what it receives is governed by Meta's own privacy policy.

The assistant on this site

Most pages of this site have a chat that answers questions about the extension. On the FAQ, support and uninstall pages it opens by itself when the screen has room for it; everywhere else it waits as a button and is not even loaded until you press it. Its answers are written by an AI model — it can be wrong, and it has no access to your extension, your accounts or your purchases. Nothing is sent until you ask it something. If you close the chat, your browser remembers that until you close the tab, so that it does not open again on the next page; that, too, stays in your browser.

Before a question leaves your browser, the page removes anything in it that looks like a secret key, a setup link, a license key, a recovery code or an email address. What is left goes to our server, together with the earlier questions and answers of the same conversation, the page you are on and its language, and — on the uninstall page, whose address carries it — the install id. Our server passes the conversation, without the install id, to the AI models that pick out the parts of this site that answer it and write the answer.

We store each question and its answer, with the page, the language, your country and the install id if there was one, so that we can read what people get stuck on and fix it. Your IP address is not stored with them. Please still do not type anything into the chat that you would not put in an email to us.

• The daily check-in and uninstall answers — our legitimate interest in operating the free plan and Pro, preventing abuse, and improving the extension. The data is pseudonymous and kept to a minimum: nothing in it names you or says which accounts you hold.
• Installs from our ads — our legitimate interest in knowing which of our ads work, limited to people who arrived through one of them, outside the EEA, UK and Switzerland.
• Conversations with the assistant — our legitimate interest in answering the question you asked and in improving the extension and its documentation from what people ask.
• Purchases, licenses and the emails with your key — performing our contract with you: issuing, delivering and supporting your license. We keep purchase records to meet our legal obligations for tax and accounting. We send no marketing email.

We do not sell personal data, and do not combine it with data from other sites or apps. The one thing shared for advertising is described under Our ads above: that an install came from one of our ads, sent to Meta. Nothing the extension sends us is ever used for advertising.

• Vercel — hosts this website and our server, including their request logs.
• Neon — the database behind our server.
• Stripe, and Link as merchant of record — payments, receipts, taxes and subscription management. What you enter at checkout is governed by their own privacy policies.
• Resend — sends the emails with your license key.
• Meta Platforms — receives the installs that came from our ads on Facebook and Instagram, as described under Our ads.
• Google — receives uninstall-survey answers through Google Forms, without the install id.

Kobaltstack LLC is in the United States, and so are several of these providers, so your data may be processed outside your own country.

• Billing events and daily open counts from the check-in: 24 months, then deleted.
• An installation's record (its latest check-in values, country, and the reason if you answered the uninstall page): while the installation keeps checking in. 180 days after it is reported uninstalled — which happens when the uninstall page opens — it is reduced to what our aggregate statistics count. An installation that simply stops checking in is reduced the same way 13 months after its last check-in. Either way we do it sooner when you ask.
• Purchase and license records, including the email address you paid with: for as long as the license can be used, and after that for as long as tax and accounting law requires.
• Conversations with the assistant: 180 days, then deleted.
• Installs from our ads: 180 days, then deleted. The cookies themselves expire 90 days after the ad was clicked.
• Rate-limit counters, kept under a salted hash of the IP address: at most two days.
• Request logs: for the short period our host keeps them.
• Uninstall-survey answers in the Google Form: for as long as they help us understand why people leave. They hold nothing that identifies you unless you typed it.

The extension keeps everything in your own browser, in the places below. It is worth being precise about each:

When the popup is open, the extension reads the address of your active tab so it can highlight the matching account, and it remembers which account you use on which site to get better at guessing. This never leaves your device and is not covered by the password vault while it is being collected.

You can switch this off under Suggest account for this site in Settings, which also erases everything it had remembered. Turning on password protection deletes it too.

It has no content scripts and no host permissions, so nothing of ours exists in a page you open. The one exception is the one you ask for: choosing Insert 2FA code from the right-click menu injects a single function into that one tab, for that one invocation, to find the field and fill it. It reads the page only far enough to decide which field should get the code, sends nothing anywhere, and leaves nothing behind when you navigate.

If you scan a QR code with your camera, the video is processed entirely in your browser and is never recorded, uploaded or transmitted. Your browser asks for permission the first time, and only when you open the scanner — the extension does not request camera access at install time, and you can revoke it in your browser's site settings.

Two requests happen on their own: the clock check and the daily check-in described above. Everything else on this list happens because you clicked something, and nothing here carries your accounts, your secret keys or the codes they generate. In full:

• time.akamai.com, timeapi.io and cloudflare.com — a clock check. TOTP codes are generated from your device clock, so if it drifts your codes stop working. These are unauthenticated requests that ask for the current time and send no information about you. Any two of the three agreeing is enough, so one of them going offline does not disable the check. The result is cached, and when none of them can be reached the extension says so in Settings rather than reporting a clock it never measured.
• api.authenticator.sh — our server: the daily check-in, and, when you buy Pro, enter a license key, restore a purchase or manage your subscription, the requests that do that, carrying the key or the email address you typed.
• checkout.stripe.com and billing.stripe.com — Stripe Checkout and the customer portal, opened in a new tab when you buy Pro or manage your subscription. What you enter there goes to Stripe and Link under their own terms.
• authenticator.sh— the welcome page opened once on install, the uninstall page opened when you remove the extension (with the install id in its address), and the help pages behind the help icon and the "how do I fix this?" link on the clock warning. Like any website, our host records ordinary request logs (IP address, browser version, time). We do not use them to identify anyone.
• chromewebstore.google.com — the store listing, opened in a new tab if you take the rating prompt or the banner suggesting our password manager. Google sees that visit the way it sees any visit to a store page; we learn nothing from it.
• authenticator.featurebase.app— the public feature board, opened if you click "request a feature". It is a third-party service and its own privacy terms apply once you are there.

Nothing else. No fonts, scripts or images are loaded from anyone else's servers — everything needed to draw the interface ships inside the extension.

Removing the extension deletes everything it stored on your device, including the backups and the install id, and ends the daily check-in.

A file you exported yourself is the exception: it is your file, in your folder, and uninstalling does not touch it. An unencrypted export is the complete list of your secrets in readable form — if you made one to move somewhere, delete it once the move is done, and remember that a Downloads folder is often the most-synced, most-searched place on the machine.

If you used Chrome Sync, the copy held under your Google account is removed by turning sync off in Settings beforeuninstalling. You can also clear it from Chrome's own sync settings.

What our server holds is described above, and deleting it is one of the rights below.

Depending on where you live — for example under the GDPR in the European Union and the United Kingdom, or under Californian law — you have the right to ask what personal data we hold about you and for a copy of it, to have it corrected or deleted, to restrict or object to how we use it, and to take it elsewhere. You can also complain to your data protection authority.

To use any of these, write to support@authenticator.sh. If you bought Pro, write from the address you paid with, or tell us what it is: that is how we find your purchase, and a request from that address also covers the installations linked to it — the one you bought from and any where your license key is active. Otherwise an installation's check-in record is not linked to your name or your email, so we can find it only by its install id — it appears in the address of the page that opens when you uninstall.

The check-in has no off switch, because without it the free plan's limit and Pro cannot work. If you object to it, uninstalling the extension stops it, and we will delete what we hold about your installation when you ask.

The extension is not directed at children, and we do not knowingly collect personal data from children. The daily check-in carries no name or contact details. If you believe a child has bought Pro, write to us and we will delete the related data.

If this policy changes in a way that affects what is collected, what is stored or what leaves your device, we will update the effective date above and note the change in the extension's release notes.

Questions about privacy or anything else: support@authenticator.sh, or the support page. For vulnerability reports use security@authenticator.sh instead — see the security policy.

The extension is open source — you do not have to take any of this on trust. Read it at github.com/authenticator-sh/2fa; the daily check-in is built, field by field, in src/billing/sync.ts. See our security policy for how to report a vulnerability.