Privacy policy
This policy explains how the AuthTool online authenticator handles account names, TOTP secrets, verification codes, browser storage, and information needed to operate the site.
How authenticator accounts and codes are handled
The account name, issuer, Base32 secret or otpauth URI, and TOTP settings such as algorithm, digit count, and period are used by this page to generate codes. Account records are kept in an encrypted vault in this browser, and account data and codes are processed locally by the page and are not uploaded to AuthTool servers. AuthTool does not sign in to Google or other services for you, and does not receive codes entered on those services.
Local encryption and browser storage
Account records are encrypted with AES-256-GCM before they are written to browser storage. LocalForage selects an available storage driver and prefers IndexedDB. With password protection on, PBKDF2-HMAC-SHA-256 derives a 256-bit encryption key from your password using 100,000 iterations. A random salt, a fresh 12-byte IV for each encryption, the ciphertext, and its authentication tag protect and verify the data. The password itself is never stored or uploaded. After unlocking, account records are held in page memory so the list and codes can be shown.
Password protection, recovery, and deletion
With password protection off, the vault is still encrypted with AES-256-GCM, but its random auto-unlock key is stored in the same browser as the ciphertext. This allows automatic access on the next visit and is not suitable for a device shared with others. With protection on, you must enter your password each time you reopen the page. AuthTool does not store your password and has no server copy that can restore it. If you forget it, the accounts cannot be decrypted; reset and clear the vault, then import setup keys or QR codes from the service again. Clearing accounts, resetting the vault, or clearing this site’s browser data removes locally saved content. There is no cloud backup or cross-device sync.
QR images and clipboard
Authenticator QR images are decoded with the browser’s local detection feature, and the image is not sent to AuthTool servers. When you click Copy code, the page asks the browser to place the current code on the clipboard. The browser and operating system manage the clipboard; avoid pasting codes into untrusted apps or websites. QR scanning requires browser support for the relevant API.
Website operation and third-party resources
When you visit a page, the hosting provider may log request times, page addresses, browser type, network address, or error details according to its configuration for security and troubleshooting. The exact records and retention period depend on the hosting provider. The page also loads Font Awesome styles from cdnjs. That provider may receive ordinary request information such as IP address, browser details, and referring page under its own policies. AuthTool does not attach your TOTP secret, account name, or code to these resource requests.
Protect your device and accounts
Local encryption does not replace device security. Malware, a malicious browser extension, an account controlled by someone else, or an already unlocked page may expose account details shown on screen. Use an up-to-date trusted browser, enable password protection on private devices, and keep recovery codes from the account provider in a safe place. Close the page when you finish. On a shared device, enable password protection and close the page before stepping away.
Policy updates
We will update this page when tool features, website resources, or data handling practices change. Review the latest information before continued use. This policy covers the AuthTool website and authenticator tool only, not the separate policies of services you sign in to or third-party resource providers.