AuthBro
Login
Application & Vault Security

AuthBro Security

Learn how AuthBro approaches authentication, data protection, privacy, and secure handling of authentication information.

Open Authenticator Report Security Issue
RFC 6238
TOTP Engine Standard
100%
In-Browser Cryptography
AES-256
Local GCM Encryption
Zero
Cloud Vault Storage

Our Security Commitment

AuthBro is engineered to provide simple, practical authentication tools while ensuring robust security for your two-factor authentication credentials. We follow strict client-side data isolation, zero-knowledge architectural principles, and standardized cryptographic algorithms.

Client-Side Execution Web Crypto API Zero Transmission

Client-Side Architecture & Vault Encryption

Your 2FA secret seeds and account details are stored locally inside your web browser sandbox (IndexedDB / localStorage). When vault protection is enabled, account seeds are encrypted with AES-256-GCM symmetric encryption using your master passphrase.

RFC 6238 Standard Compliance

AuthBro Authenticator generates 30-second Time-based One-Time Passwords (TOTP) in full compliance with IETF RFC 6238 using standard HMAC-SHA1 algorithms. Codes are calculated locally in real time without transmitting secrets to external servers.

Encrypted Backup Portability

You retain complete physical ownership of your authentication data. AuthBro allows exporting password-protected JSON backup files so you can safely migrate or restore your credentials across devices.

Our Security Philosophy

AuthBro is engineered to provide simple, practical authentication tools while ensuring robust security for your two-factor authentication credentials. We follow strict client-side data isolation, zero-knowledge architectural principles, and standardized cryptographic algorithms.

Client-Side Architecture & Vault Encryption

Your 2FA secret seeds and account details are stored locally inside your web browser sandbox (IndexedDB / localStorage). When vault protection is enabled, account seeds are encrypted with AES-256-GCM symmetric encryption using your master passphrase.

RFC 6238 Standard Compliance

AuthBro Authenticator generates 30-second Time-based One-Time Passwords (TOTP) in full compliance with IETF RFC 6238 using standard HMAC-SHA1 algorithms. Codes are calculated locally in real time without transmitting secrets to external servers.

Encrypted Backup Portability

You retain complete physical ownership of your authentication data. AuthBro allows exporting password-protected JSON backup files so you can safely migrate or restore your credentials across devices.

Did you find this security policy helpful?
4

How to Verify Our Security Guarantee Yourself

You don't need to take our word for it. Open your browser Developer Tools (F12 or Ctrl+Shift+I), switch to the Network tab, and generate 2FA tokens or scan QR codes. You will observe zero outbound API requests containing your 2FA secrets or seed keys.

Report a Security Issue

We take vulnerability reports and security feedback very seriously. If you have identified a security vulnerability, bug, or cryptographic concern in AuthBro, please reach out to our security team directly.

authbro.mail@gmail.com

Frequently Asked Security Questions

AuthBro uses standard Web Crypto API AES-256-GCM encryption with PBKDF2 key derivation from your master passphrase before writing vault data to local storage.
Never. AuthBro computes verification codes strictly inside browser memory using local JavaScript engines.
Please email our security team directly at authbro.mail@gmail.com with issue reproduction steps and technical context.