Security Features
Private Authenticator is built with security as the foundation. Every feature is designed to protect your sensitive authentication data using industry-standard encryption and security practices.
Encryption & Data Protection
Military-Grade Encryption
AES-256-GCM encryption for all stored data with PBKDF2 key derivation using 100,000 iterations and SHA-256 hashing
Individual Entry Encryption
Each 2FA entry is encrypted separately with unique salts and initialization vectors
Zero Plain-text Storage
Secrets and entry data are never stored in plain text - everything is encrypted at rest
Authentication & Access Control
Master Password Protection
App requires a master password to unlock and access stored entries
Automatic Locking
App automatically locks when password session expires, clearing all sensitive data from memory
Session Security
Password is only kept in memory during active session and cleared when locked
Secure Backup & Recovery
Encrypted Backups
Backup files are fully encrypted with user-provided passwords using the same AES-256-GCM encryption
Backup Validation
Import process validates backup file structure and entry integrity before restoration
Tamper Protection
Backup files include metadata and version information to prevent tampering
Code Generation Security
RFC-Compliant Standards
Implements RFC-compliant TOTP/HOTP using HMAC with SHA-1/256/512 algorithms
Cryptographically Secure Random
Uses cryptographically secure random number generation for encryption keys and initialization vectors
Input Validation
Base32 secret validation prevents malformed or malicious secret inputs
Privacy & Data Handling
Local-Only Operation
All data processing happens locally - no network communication or cloud storage
Secure Context Required
Uses modern browser security APIs that require HTTPS/secure contexts
User Interface Security
Secret Visibility Control
Secrets can be temporarily revealed but are hidden by default for shoulder-surfing protection
Quick Generator
Allows testing codes without saving secrets permanently for enhanced privacy
Secure Input Handling
QR code scanning and manual entry with validation before storage
Technical Security Measures
IndexedDB Isolation
Uses browser's secure storage with proper database versioning and transaction management
Memory Management
Sensitive data is cleared from memory when app is locked to prevent memory dumps
Secure Error Handling
Error handling that doesn't leak sensitive information in logs or user messages
Security Commitment: Private Authenticator is designed with a security-first approach. We use industry-standard encryption, follow security best practices, and maintain complete transparency about our security measures. Your authentication data is never transmitted or stored on external servers - it remains encrypted and secure on your device.
Security features last updated: 10/15/2026