Security
How Authenticator protects your codes
The security architecture, in plain language.
Codes are generated on your device
Authenticator implements standard TOTP: your one-time codes are computed locally from a shared secret and the current time. No server is involved in generating or delivering a code, and the app works fully offline — in airplane mode, abroad, or with no signal.
Sync is end-to-end encrypted
When you enable sync, your vault is encrypted on your device before anything leaves it, using a key that never leaves your hardware. What travels and what is stored is ciphertext we cannot read. There is no server-side reset that could expose your secrets — that is the point.
New devices need approval
Adding a phone, tablet or Mac uses a master-device model: an existing trusted device must explicitly approve the new one before it receives the encrypted vault. A leaked password alone is not enough to clone your codes onto an attacker's device.
The app locks locally
The vault sits behind Face ID, Touch ID, or your device passcode. Losing an unlocked phone does not mean losing your accounts, and screenshots of code screens can be limited by the operating system's protections.
What we can see — and what we can't
We cannot read your secrets, your account names, or your codes. The app requires no account to start. Usage analytics are strictly opt-in and, when enabled, cover app-level events only — never the contents of your vault.
Reporting a vulnerability
If you believe you have found a security issue in Authenticator, contact us at contact@vidus6.com. We read every report, respond as fast as we can, and credit researchers who report responsibly.
Security questions we didn't answer here? Contact us.