What stays on your device
When a valid key is entered, account names, secret keys, algorithm settings, creation dates and profile order are saved automatically in IndexedDB. Changes in a card update only that profile automatically; Add profile opens a new card. TOTP generation, QR image reading and backup encryption happen in the browser. The application does not upload your keys, generated codes, profiles, backup files or backup passwords.
Theme and language preferences are stored in localStorage. A service worker can cache the site’s static pages, scripts, styles and icons. Secret keys are never embedded in those cached responses. No cookies are used to store keys.
What the web server sees
The server renders pages and delivers scripts, styles and icons. When the site loads, the LiveInternet counter sends visit data to counter.yadro.ru, including the page URL and title, screen information and a referring page when available. The counter provider also receives ordinary connection information such as an IP address. Authenticator keys, codes and profiles are not sent to the counter. We do not use remote code-generation services or fonts.
Contact form
If you use the contact form, the name you provide, your reply address and message are sent from our server to our Telegram chat. They are separate from your authenticator profiles. A short-lived session cookie is used to check the form request and limit repeat submissions. Do not send secret keys, one-time codes or backup passwords in your message.
Local storage is not a password-protected vault
Saved browser profiles are not encrypted with a master password. Someone with access to your browser profile, malicious browser extensions or a compromised device may be able to access your keys. A compromised copy of the website could also read data stored for its origin. Use trusted devices, protect your system account and keep software updated.
Encrypted backups
Exported backups use AES-256-GCM. The key is derived from your password using PBKDF2-HMAC-SHA-256 with 600,000 iterations and a fresh random salt. Each export uses a fresh random encryption nonce. The password is not saved. There is no password recovery; keep it separately from the backup file.
When profiles can disappear
- You clear this website’s data or delete your browser profile.
- You leave a private or incognito session.
- The browser automatically removes stored data.
- You use a different device, browser or website address.
There is no automatic expiry after a fixed number of days. Browser persistence is still not guaranteed. Keep encrypted backups and the original services’ recovery codes. Importing a backup adds profiles without replacing the existing collection.
Your controls
You can delete a profile from its card menu. Clear the website’s storage in your browser settings to remove all profiles and cached files on this device. Downloads you saved separately are not deleted by clearing the website.
Supported browsers may let you request persistent storage. This reduces automatic eviction; it does not prevent manual deletion or replace a backup.