We're on Product Hunt today! Leave a comment
Authenticator 1.16.0 is here. See what's new
Your secret keys, account names and codes never reach us in a form we can read — Pro's optional cloud backup sends them end-to-end encrypted, with a key we never have. Since version 1.14.0 the extension does check in with our server once a day, for the free plan and Pro. This page says exactly what that sends and why, who handles it and for how long, where everything else is stored, and what, if anything, leaves your device. It covers the Chrome extension and the Mac app; what the Mac app does differently is under The Mac app.
Effective 4 November 2026
2FA Authenticator — the Chrome extension and the Mac app, Authenticator for Mac — is published by Kobaltstack LLC, 447 Broadway, 2nd Floor, 3436, New York, NY 10013, US. We are responsible for (the "controller" of) the personal data this policy describes. For anything in it, write to support@authenticator.sh.
Never: your secret keys, your account names or issuers, the codes they generate, or the sites you use them on. There is no account to create and no login, and there is no crash reporting. The one exception is yours to choose: Pro's cloud backup, if you turn it on, stores your accounts on our server encrypted with a code that is never sent to us — so we still cannot read them (see Cloud backup below).
Once a day — when the browser starts, or after the popup has opened, never on the way to showing a code — the extension sends our server, api.authenticator.sh, these fields and nothing else:
While an installation is new — its first three days — these last events are sent within minutes rather than with the next daily check-in, so that we can see where people who give up in their first minutes got stuck.
Our server records the country the request came from, which our host works out from your IP address. The IP address itself is not stored: to limit how often requests can be made, the server counts them under a salted hash of it, and those counters are deleted within two days. The server answers with a signed policy — whether this installation has an account limit, and how high it is — and, if the installation holds one, a signed license. To the installation you bought Pro on, and only until it reports that it has it, the answer also carries your license key, so Pro can reach your other Chrome profiles without you typing it (see Chrome Sync below). An installation where you typed the key in is never sent one.
We use this to decide whether the free plan's account limit applies to an installation, to deliver and check Pro, to keep the service from being abused, and to understand how the free plan and Pro are used so we can improve them — for example, how many accounts people keep, which is how the limit is chosen, and whether a change makes people uninstall.
Payment happens on Stripe Checkout, in a new tab — from the Mac app, in a new tab of your default browser. Link, Stripe's payment service, is the merchant of record: it takes your payment details, issues receipts, handles taxes and answers questions about an order, under its own privacy policy. Your card details never reach us. With the checkout, Stripe receives the install id you bought from, the plan, and which policy and offer led to it, so the purchase can be matched to your installation, and keeps the install id with the purchase; the checkout opens in the extension's language.
From Stripe we receive the email address you paid with, the country of your billing address, and the purchase details — plan, amount, currency, tax, the status of the payment and subscription, and Stripe's ids for them. We use these to issue your license key (2FA-XXXXX-XXXXX-XXXXX-XXXXX), email it to you, send it again if you ask, and let you manage your subscription. The key is stored as a hash, plus an encrypted copy so it can be sent again. A license works on up to five installations: we record which installations it is active on and when each last checked in, and one that has not checked in for 60 days frees its place. When the payment has gone through, the page Stripe sends you back to on this site asks our server for the result, using the checkout id in its address. For the first three days after the purchase it shows your key and a masked version of your email address; after that it shows only that masked address, where the key was sent. What Pro includes is on the Pro page.
Pro can keep an encrypted copy of your accounts on our server, so that losing your computer does not mean losing your codes. It is off until you turn it on in the extension's settings. When you do, the extension shows you a backup recovery code and encrypts your accounts with a key derived from it (AES-256-GCM) before anything leaves your browser. The code is kept in your browser and, if Chrome sync is on, in your Google account, so your other Chrome profiles can open the same copies; it is never sent to us. We therefore cannot read the copies, and cannot recover them for you if the code is lost.
For each copy our server stores the encrypted data, its size, when it was made, the license, the installation that sent it, and the short hash of the code it was made under. For the license it stores a short hash of the current code, which tells a device which code a copy needs, and a hash of a second value derived from the code, which proves a device holds it before the server accepts a copy or deletes them all; neither lets us open a copy. A copy is sent when you turn cloud backup on, when you press Back up now, and otherwise when the extension opens and what it holds differs from the last copy that browser sent; each of your browsers sends its own. Each time a copy arrives we keep the 20 newest, the newest of each hour of the last day, the newest of each day for 30 days, and the newest from each of your 10 most recently active browsers; older copies are deleted.
From version 1.16.0 cloud backup also keeps your devices in sync: each browser asks our server for the list of your license's copies and reads the newest copy of every other browser — when the extension opens, when you come back to its window, and every few minutes while it stays open, at most once a minute. In that list each copy carries a tag computed from the license and the installation that sent it, so that a browser can tell its own copies from the others'. Our server therefore sees when a browser with cloud backup on asks for the list; it still cannot see what any copy holds — the edits and deletions being synced travel inside the encrypted copies.
When you remove the extension, your browser opens our uninstall pagewith the install id in its address, and with how far the installation got towards a first account — the last of the steps above, such as "picked Google Authenticator" or "camera not allowed". As it opens, the page tells our server, with the install id and that step and nothing else, that the installation was removed; our server marks it as uninstalled. The page then asks one question: why. Picking a reason sends that reason, with the install id, to our server, which records it. The same reason — without the install id — goes on to a Google Form, together with whatever you type in the box under it, an address if you want a reply, the page's language, and a random id made for that page view so a reason and the text typed after it read as one answer.
Your browser never contacts Google: the page posts to our own website, whose server forwards the answer, so no cookie of theirs is set and nothing else about you — your address, your browser, the page you came from — travels with it. Answering is entirely optional, and closing the tab sends nothing at all.
This website runs no analytics or tracking scripts, and loads nothing from Meta, Google Analytics or any other ad network. It sets advertising cookies only for people who arrive through one of our ads, as described below. If you pick a language in the language selector, a cookie remembers that choice; a notice you close, and the size you give the assistant's window, are remembered in your browser's local storage. None of it is sent anywhere else. The site's typeface is served from our own server, not from Google Fonts. Two things come from elsewhere: the footer shows Product Hunt's badge, loaded from Product Hunt's server without telling it which page you were on, and the feedback page at /rate embeds a Google Form, which your browser loads from Google when you open that page. Like any website, ours keeps ordinary request logs (IP address, browser version, time) at our host.
The code generator page asks this site for one thing: the current time, so it can tell you when your device clock has drifted far enough to have your codes refused. It is requested only once you have entered a secret, and the secret is never part of it — the code is computed in your browser and the secret never leaves the tab. The request carries no cookie and no referrer; like every other request to this site it reaches ordinary request logs (IP address, browser version, time) and nothing else. If it fails, the page falls back to your device clock and keeps working.
We advertise the extension on Facebook and Instagram. Those ads link to an address on this site (/go) that sends you straight on to the Chrome Web Store. On the way through, our server sets three cookies on this domain, for 90 days: _fbc, the click identifier Meta added to the ad's link; _fbp, a random browser identifier; and _attr, which campaign and ad you clicked. They can be read only by our server, not by scripts on the page. Visitors from the European Economic Area, the United Kingdom and Switzerland get none of them.
If you then install the extension, the welcome page it opens tells our server so. When those cookies are present, our server records the install — the three cookies, the install id the extension puts in the welcome page's address, your browser version, country and the time — so that we can tell which campaign brought installations that went on to use the extension or buy Pro, and sends Meta Platforms the click and browser identifiers, your IP address and browser version (not the install id), so that Meta can tell which ad led to an install. Your IP address is passed on and not stored. Without those cookies — that is, for everyone who did not come from one of our ads — nothing is recorded or sent. Nothing about the extension itself, your accounts or your codes is ever part of it. You can delete the cookies in your browser at any time; what Meta does with what it receives is governed by Meta's own privacy policy.
Most pages of this site have a chat that answers questions about the extension. On the FAQ, support and uninstall pages it opens by itself when the screen has room for it; everywhere else it waits as a button and is not even loaded until you press it. Its answers are written by an AI model — it can be wrong, and it has no access to your extension, your accounts or your purchases. Nothing is sent until you ask it something. If you close the chat, your browser remembers that until you close the tab, so that it does not open again on the next page; that, too, stays in your browser.
Before a question leaves your browser, the page removes anything in it that looks like a secret key, a setup link, a license key, a recovery code or an email address. What is left goes to our server, together with the earlier questions and answers of the same conversation, the page you are on and its language, and — on the uninstall page, whose address carries it — the install id. Our server passes the conversation, without the install id, to the AI models that pick out the parts of this site that answer it and write the answer.
We store each question and its answer, with the page, the language, your country and the install id if there was one, so that we can read what people get stuck on and fix it. Your IP address is not stored with them. Please still do not type anything into the chat that you would not put in an email to us.
We do not sell personal data, and do not combine it with data from other sites or apps. The one thing shared for advertising is described under Our ads above: that an install came from one of our ads, sent to Meta. Nothing the extension sends us is ever used for advertising.
Kobaltstack LLC is in the United States, and so are several of these providers, so your data may be processed outside your own country.
The extension keeps everything in your own browser, in the places below — except what you choose to send elsewhere: Chrome Sync, and Pro's cloud backup. It is worth being precise about each:
| Where | What | Leaves your device? |
|---|---|---|
| Browser local storage | Your accounts and settings. Encrypted if you turn on password protection. If you turned on cloud backup, its backup recovery code — sealed with your password if password protection is on — and a fingerprint of the last copy sent, so an unchanged list is not sent again. | No |
| Browser local storage (billing) | The install id, the last signed policy and license, the license key this installation holds — typed in, or received after buying Pro on it — and the billing events and daily open counts waiting to be sent. No account data. | The daily check-in, described above |
| Browser session memory | The key that unlocks your codes, while the vault is unlocked; and, while you turn cloud backup on, the new backup recovery code, so it stays the same if the popup closes. Never written to disk; cleared when the browser closes. | No |
| Chrome Sync (optional) | A copy of your accounts, so they appear in your other Chrome browsers — and whether this installation predates version 1.14.0 and the license key it holds, so those browsers pick them up too and turn Pro on by themselves — and, if you turned cloud backup on, its backup recovery code (sealed with your password if password protection is on), so those browsers can open the same copies. Turning sync off removes all of it; turning it back on puts it back. | Yes — to Google, under your account |
| IndexedDB | Seven rolling daily snapshots, so a mistake does not cost you your accounts. | No |
| Our server (Pro cloud backup, optional) | Copies of your accounts, encrypted in your browser with a key derived from your backup recovery code, which we never receive. Off until you turn it on. | Yes — encrypted; we cannot read it |
| A file you export | Whatever you chose to write, wherever you chose to put it. Three of the four export formats are unencrypted — only the password-protected one is not. Backup files also carry a one-way hash of your installation id, unencrypted, so the Mac app can tell which installation wrote them. | Only if you put it somewhere that syncs |
Worth understanding about Chrome Sync. It is a Chrome feature, not ours: the data is replicated through your own Google account, and we never receive it. But with password protection off, your accounts are stored there unencrypted, which means Google holds them. Turning on password protection encrypts them before they are ever handed to sync. Turning sync off in Settings stops the replication and removes what is already there.
When the popup is open, the extension reads the address of your active tab so it can highlight the matching account, and it remembers which account you use on which site to get better at guessing. This never leaves your device and is not covered by the password vault while it is being collected.
You can switch this off under Suggest account for this site in Settings, which also erases everything it had remembered. Turning on password protection deletes it too.
It has no content scripts and no host permissions, so nothing of ours exists in a page you open. The one exception is the one you ask for: choosing Insert 2FA code or Copy 2FA code for this site from the right-click menu injects a single function into that one tab, for that one invocation, to fill the field or put the code on the clipboard. It reads the page only far enough to decide which field should get the code, sends nothing anywhere, and leaves nothing behind when you navigate. Websites you tie to an account by hand are stored inside that account, like its name, and never sent to us.
If you scan a QR code with your camera, the video is processed entirely in your browser and is never recorded, uploaded or transmitted. Your browser asks for permission the first time, and only when you open the scanner — the extension does not request camera access at install time, and you can revoke it in your browser's site settings.
Two requests happen on their own: the clock check and the daily check-in described above — three, if you turned on Pro's cloud backup, whose copies go out encrypted when your accounts change. Everything else on this list happens because you clicked something, and nothing here carries your accounts, your secret keys or the codes they generate in a form we can read. In full:
Nothing else. No fonts, scripts or images are loaded from anyone else's servers — everything needed to draw the interface ships inside the extension.
Authenticator for Mac is the extension's interface and core as a Mac app, so everything above applies to it — the daily check-in, Pro, cloud backup, the clock check — except for what this section says. Like the extension, it never sends your secret keys, account names or codes anywhere in a form we can read.
The same fields as the extension's, with the platform set to desktop and the operating system to mac, so we can tell the app's installations from the extension's. It has no uninstall page: deleting the app tells our server nothing, and its installation's record is reduced like any installation that stops checking in, 13 months after its last check-in — or sooner when you ask.
If you move your accounts from the extension, import a backup file it wrote, or press “Connect the Mac app” on our site, the app tells our server which extension installation it came from, so we can count people who use both. It sends a one-way hash of the extension's installation id, not the id; it adds no keys, account names or codes, and grants nothing.
To put the right account first, the app asks the browser in front — Chrome, Safari, Arc, Brave, Edge, Vivaldi or Opera — for the address of its current tab, using Apple Events. macOS asks your permission once for each browser (System Settings → Privacy & Security → Automation). Only the address is read, not the page, and only when you open the app's window or its palette.
In other apps, it remembers which account you used in which app: the app's name and the title of its front window, next to the account. The window title can be read only once you allow Accessibility. This memory stays on your Mac, is encrypted with your vault when password protection is on, and is erased by turning off the suggestion setting in Settings.
When you press Enter in the ⌘⇧2 palette and you have allowed Accessibility, the app types the code as keystrokes into the field you were in. Without that permission it copies the code instead. A copied code is marked for clipboard managers as concealed and transient, is kept to this Mac rather than handed to Universal Clipboard, and is cleared after 45 seconds unless you have copied something else since.
With Screen Recording allowed, the app takes a screenshot when you ask it to scan the screen, looks for a QR code in it on your Mac, and deletes the screenshot right away. It is never kept or sent anywhere, and nothing is captured unless you ask.
Scanning a QR code with the camera works as in the extension, with macOS asking for the camera permission the first time. The video is processed on your Mac and never recorded or sent. The camera turns off when you leave the scanner or hide the window.
Your accounts and settings are in ~/Library/Application Support/sh.authenticator.app/ (storage-local.json; encrypted when password protection is on), next to device-key.json, the Touch ID key sealed by your Mac's Secure Enclave — usable only on this Mac, and only after Touch ID or your Mac's password. Automatic backups are in ~/Library/WebKit/sh.authenticator.app/. Exports are saved to your Downloads folder. None of these leave your Mac unless you copy them somewhere — or a backup of your Mac, such as Time Machine, includes them.
Deleting the app does not delete this data, so a reinstall finds your accounts again. To erase it: export anything you still need, quit the app (its menu bar icon → Quit Authenticator), then delete both folders named above — in Finder with Go → Go to Folder, or in Terminal with rm -rf ~/Library/"Application Support"/sh.authenticator.app ~/Library/WebKit/sh.authenticator.app — and move the app to the Trash.
The app can copy your accounts from the extension on the same Mac. It reads the extension's data from the browser profile on this Mac, and asks for the extension's password if it has one. Nothing goes through our server, and the extension's data is left as it was.
Buying Pro or managing a subscription opens Stripe in your default browser; the license then arrives in the app by itself, or when you enter your license key in the app. The app checks authenticator.sh for new versions, downloads them from there, and installs only an update signed with our key. Those requests carry nothing about you or your accounts; like every request to this site they reach ordinary request logs (see This website).
The edition from the Mac App Store runs in Apple's sandbox and does less: it copies codes but never types them into other apps, does not ask your browser for its tab address or read other apps' window titles, and cannot read the Chrome extension's data. It needs no Accessibility or Automation permission; scanning the screen uses Screen Recording as above. Its check-in carries the same fields with the platform set to mas. Its data is in the app's sandbox container, ~/Library/Containers/sh.authenticator.app/, and moving the app to the Trash leaves it there too. Updates come from the App Store.
Pro is bought there with an App Store in-app purchase, not with Stripe: Apple takes the payment and handles receipts, refunds and subscriptions under its own terms and privacy policy, and we never see your payment details, name or email address. The app sends our server the transaction Apple signed, which carries the product, its price and currency, its dates and status, and a token equal to the install id; Apple also notifies our server when a subscription renews, ends or is refunded. We check the signature, keep these details with the install id, and issue the same license as a purchase from this site.
Removing the extension deletes everything it stored on your device, including the automatic backups and the install id, and ends the daily check-in.
Deleting the Mac app does not: its data stays on your Mac until you delete it, as described under The Mac app.
A file you exported yourself is the exception: it is your file, in your folder, and uninstalling does not touch it. An unencrypted export is the complete list of your secrets in readable form — if you made one to move somewhere, delete it once the move is done, and remember that a Downloads folder is often the most-synced, most-searched place on the machine.
If you used Chrome Sync, the copy held under your Google account is removed by turning sync off in Settings beforeuninstalling. You can also clear it from Chrome's own sync settings.
Uninstalling does not delete cloud backup copies, so that a new installation can restore them — with your license key and backup recovery code, even after Pro has ended. Turning cloud backup off in Settings (which needs the backup recovery code), or starting over there with your license key, deletes them, for every browser at once; if you can do neither, write to support@authenticator.sh and we will delete them.
What our server holds is described above, and deleting it is one of the rights below.
Depending on where you live — for example under the GDPR in the European Union and the United Kingdom, or under Californian law — you have the right to ask what personal data we hold about you and for a copy of it, to have it corrected or deleted, to restrict or object to how we use it, and to take it elsewhere. You can also complain to your data protection authority.
To use any of these, write to support@authenticator.sh. If you bought Pro, write from the address you paid with, or tell us what it is: that is how we find your purchase, and a request from that address also covers the installations linked to it — the one you bought from and any where your license key is active. Otherwise an installation's check-in record is not linked to your name or your email, so we can find it only by its install id — it appears in the address of the page that opens when you uninstall.
The check-in has no off switch, because without it the free plan's limit and Pro cannot work. If you object to it, uninstalling the extension stops it, and we will delete what we hold about your installation when you ask.
The extension is not directed at children, and we do not knowingly collect personal data from children. The daily check-in carries no name or contact details. If you believe a child has bought Pro, write to us and we will delete the related data.
If this policy changes in a way that affects what is collected, what is stored or what leaves your device, we will update the effective date above and note the change in the extension's release notes.
Questions about privacy or anything else: support@authenticator.sh, or the support page. For vulnerability reports use security@authenticator.sh instead — see the security policy.
The extension is open source — you do not have to take any of this on trust. Read it at github.com/authenticator-sh/2fa; the daily check-in is built, field by field, in src/billing/sync.ts. See our security policy for how to report a vulnerability.