We run no servers, hold no accounts and receive none of your data. This page says exactly where everything is stored and what, if anything, leaves your device.
Effective 1 August 2026
Nothing. The extension has no backend. There is no account to create, no login, no analytics, no crash reporting and no telemetry of any kind. We never see your accounts, your secret keys, the codes they generate, or which services you use them with.
This website sets no cookies and runs no analytics or tracking scripts.
The code generator page asks this site for one thing: the current time, so it can tell you when your device clock has drifted far enough to have your codes refused. It is requested only once you have entered a secret, and the secret is never part of it — the code is computed in your browser and the secret never leaves the tab. The request carries no cookie and no referrer; like every other request to this site it reaches ordinary request logs (IP address, browser version, time) and nothing else. If it fails, the page falls back to your device clock and keeps working.
One page sends something the other way, and only because you pressed a button on it. When you uninstall, your browser opens our uninstall page, which asks one question: why. Picking a reason sends that reason; the box under it sends whatever you type, and the address field sends an address if you want a reply. Nothing else goes with it — no identifier that survives the page, nothing read from the extension, which is gone by then, and nothing about your accounts, which were deleted with it. Answering is entirely optional, and closing the tab sends nothing at all.
Those answers reach us through a Google Form, and this site is the only thing that talks to Google: the page posts to our own server, which forwards the answer. Your browser never contacts Google, so no cookie of theirs is set and nothing about you — your address, your browser, the page you came from — travels with it. What arrives is what you chose and what you typed.
Everything the extension knows lives in your own browser. There are four places, and it is worth being precise about each:
| Where | What | Leaves your device? |
|---|---|---|
| Browser local storage | Your accounts and settings. Encrypted if you turn on password protection. | No |
| Browser session memory | The key that unlocks your codes, while the vault is unlocked. Never written to disk; cleared when the browser closes. | No |
| Chrome Sync (optional) | A copy of your accounts, so they appear in your other Chrome browsers. | Yes — to Google, under your account |
| IndexedDB | Seven rolling daily snapshots, so a mistake does not cost you your accounts. | No |
| A file you export | Whatever you chose to write, wherever you chose to put it. Three of the four export formats are unencrypted — only the password-protected one is not. | Only if you put it somewhere that syncs |
Worth understanding about Chrome Sync. It is a Chrome feature, not ours: the data is replicated through your own Google account, and we never receive it. But with password protection off, your accounts are stored there unencrypted, which means Google holds them. Turning on password protection encrypts them before they are ever handed to sync. Turning sync off in Settings stops the replication and removes what is already there.
When the popup is open, the extension reads the address of your active tab so it can highlight the matching account, and it remembers which account you use on which site to get better at guessing. This never leaves your device and is not covered by the password vault while it is being collected.
You can switch this off under Suggest account for this site in Settings, which also erases everything it had remembered. Turning on password protection deletes it too.
It has no content scripts and no host permissions, so nothing of ours exists in a page you open. The one exception is the one you ask for: choosing Insert 2FA code from the right-click menu injects a single function into that one tab, for that one invocation, to find the field and fill it. It reads the page only far enough to decide which field should get the code, sends nothing anywhere, and leaves nothing behind when you navigate.
If you scan a QR code with your camera, the video is processed entirely in your browser and is never recorded, uploaded or transmitted. Your browser asks for permission the first time, and only when you open the scanner — the extension does not request camera access at install time, and you can revoke it in your browser's site settings.
The clock check below is the only request the extension makes on its own. Everything else on this list happens because you clicked something, and nothing here carries your accounts, your secret keys or the codes they generate. In full:
Nothing else. No fonts, scripts or images are loaded from anyone else's servers — everything needed to draw the interface ships inside the extension.
Removing the extension deletes everything it stored on your device, including the backups.
A file you exported yourself is the exception: it is your file, in your folder, and uninstalling does not touch it. An unencrypted export is the complete list of your secrets in readable form — if you made one to move somewhere, delete it once the move is done, and remember that a Downloads folder is often the most-synced, most-searched place on the machine.
If you used Chrome Sync, the copy held under your Google account is removed by turning sync off in Settings beforeuninstalling. You can also clear it from Chrome's own sync settings.
Since we hold nothing, there is nothing to request from us and nothing for us to delete on your behalf.
The extension is not directed at children and collects no personal information from anyone, of any age.
If this policy changes in a way that affects what is stored or what leaves your device, we will update the effective date above and note the change in the extension's release notes.
Questions about privacy or anything else: support. For vulnerability reports use security@authenticator.sh instead — see the security policy.
The extension is open source — you do not have to take any of this on trust. Read it at github.com/authenticator-sh/2fa, and see our security policy for how to report a vulnerability.