We're on Product Hunt today! Leave a comment

Authenticator 1.15.2 is here. See what's new

Install

Version 1.15.0

Lose the computer, keep your codes

With Pro, the extension keeps an encrypted copy of your accounts on our server. It is locked with a recovery code that never leaves your browser — we cannot open it.

A cloud copy as it reaches our server, field by field. The accounts are the last line: encrypted in your browser before they are sent.

How it works

  1. 1Open “Settings” → “Backup & Restore” → “Cloud backup” and press “Turn on”. You get your backup recovery code; type it once to confirm you saved it, and the first copy is sent.
  2. 2From then on a copy is sent whenever your accounts change and the extension opens, or when you press “Back up now”. Restoring a copy only adds the accounts that are missing.
  3. 3On a new computer, enter your license key, then the recovery code: the newest copy comes in at once. If Pro has ended, “Restore from cloud backup with your license key” still finds your copies for 90 days.

Why we cannot read it

A backup of your 2FA secrets on someone else's server deserves a hard look, so here is exactly what reaches ours and what it can do with it.

Encrypted before it leaves your browser

Your accounts are encrypted in the extension with AES-256-GCM, under a key derived from your recovery code. What we store is that ciphertext — no name, issuer, secret or code can be read in it.

The code never reaches us

Our server keeps a short id of the code and a hash of a second value derived from it, which proves a browser holds the code. Neither lets anyone work out the code or the key. If you lose the code, we cannot open your copies either.

Restoring only adds

Like the automatic copies on your computer, a cloud copy only adds the accounts that are missing. Nothing you have is replaced or removed by a restore.

Only the code can delete it

Turning cloud backup off deletes every copy, and it takes the code to do it — the install id the extension uses elsewhere is not enough. With password protection on, the code kept in the extension is encrypted under your password too.

None of this has to be taken on trust. The encryption, the request and the restore are in one file: read it on GitHub.

Also in this release

  • A second style: pick “Modern” in “Settings” → “Appearance”, where light and dark are switched too. “Classic” stays the default, and nothing changes until you choose.
  • To learn where new users get stuck, a new installation now reports how adding its first account went — which way was picked, which step was reached, which error was shown, as kinds and counts, never what was scanned or typed — within minutes during its first three days. Installations from before this release do not.
  • The uninstall page now also carries how far a new installation got towards its first account, and the welcome page the install id, which our server keeps only for installations that came from one of our ads.
  • If Pro ends, your cloud copies stay restorable for 90 days. Buying Pro again from a browser that held the earlier license takes the backup over to the new one.
  • No new permissions. Still no host permissions and no content scripts.

The full technical changelog is on GitHub: release notes.

Not installed yet?

Free to use, open source, and no account to sign up for.

Add to Chrome

Earlier releases