Privacy Policy

2FA Authenticator is a small, free, independently operated web project by Naman. This policy explains what information the platform handles, where it lives, and the choices you control. It applies to the website at https://2fa.namansoni.in and its API.

You can use the entire platform without an account. In that mode, your authenticator entries (names, issuers, setup keys, and settings) are written to your own browser's local storage and cache on your device. Codes are generated locally in your browser. No credentials, no identifiers, and no personal data are transmitted to our servers in this mode.

Clearing your browser data for this site removes those entries permanently — that is the trade-off for staying anonymous, and the reason the app repeatedly suggests creating an account or exporting a backup.

If you create an account, we store the following, and only the following:

• Username — the name you pick. We never ask for an email address, phone number, or real name.
• Password hash — a salted scrypt derivation. Your plaintext password is never stored or logged.
• 2FA credentials — each setup key is encrypted with AES-256-GCM using a server-side key before being written to the database. Names, issuers, and settings are stored alongside them.
• Timestamps — when your account and credentials were created or updated.

Secrets are decrypted only in memory, server-side, to compute your current codes. To see a secret in your browser you must re-confirm your account password, and exports of all secrets require the same confirmation. There is no password reset — and therefore no "account recovery" path that could expose your secrets.

• Session cookie — an httpOnly, signed token that keeps you signed in for 30 days. It contains your internal user id only.
• Theme preference — light/dark choice, stored in your browser.
• Local-mode credentials — in browser-only mode, stored in local storage as described above.

We do not set advertising, analytics, or fingerprinting cookies, and no third-party scripts are embedded on this site.

Our hosting providers may automatically log standard technical information for every HTTPS request (such as IP address, timestamp, and user agent) for security and abuse prevention. These logs are short-lived, are not used to profile you, and are governed by the providers' own policies (see section 7).

Security measures include: TLS for all traffic; AES-256-GCM authenticated encryption for secrets at rest; salted scrypt password hashing; httpOnly session cookies; rate limiting on authentication and secret-reveal endpoints; and stateless sessions that keep no server-side session tables. Revealing a stored secret or exporting a backup always requires re-entering your password.

These practices reduce but do not eliminate risk. No encryption, hashing, or operational discipline can guarantee that an online service will never be breached or lose data. As stated in the Terms, the platform is provided at your own risk, without responsibility and without promises — keep your own offline backups of setup keys.

The platform runs on third-party infrastructure (a serverless hosting provider and a managed Postgres database provider). Your account data lives on that infrastructure and is processed by those providers on our behalf. Payment links in the footer lead to an external payment service; any donation is processed entirely there and we do not receive or store payment details.

We do not sell, rent, or trade your data. We do not share it with advertisers, data brokers, or analytics firms. Data leaves our systems only when legally compelled, or as strictly necessary to operate on the third-party infrastructure described in section 7.

Browser-only data lives exactly as long as your browser keeps it — delete it anytime by clearing site data, or by removing individual credentials in the app. Account data is retained until you delete it: deleting your account (available in the account menu, password confirmation required) immediately and permanently removes your username, password hash, and every stored credential.

Because we collect no personal identifiers beyond your chosen username, the practical rights that matter here are: access (sign in and view everything), portability (export a JSON backup or QR codes at any time), and erasure (delete individual credentials or the whole account instantly). If you believe any of these are not working, contact us via the GitHub account in the footer and it will be fixed.

The platform is not intended for children under 13. We do not knowingly collect data from children under 13; if an account was created by one, contact us to have it removed.

This policy may be updated as the service evolves. The published version at this URL is the one in force. If a change materially affects how your data is handled, it will be reflected clearly in the "last updated" date and, where practical, in the app itself.

Reach out through the GitHub account listed in the footer for any privacy question or request.