Security & Privacy
Your secrets never leave you
Here's exactly how Vertexz Authenticator protects your accounts — no marketing fluff.
On-device generation
Codes are computed in your browser using the Web Crypto API (HMAC-SHA1/256/512). Your secret keys are never sent to any server.
Encrypted local vault
Saved accounts are encrypted with AES-256-GCM. The key is derived from your passphrase using PBKDF2-SHA256 with 310,000 iterations and a random salt.
Your passphrase stays with you
The passphrase is never stored or transmitted. Locking the vault clears decrypted data from the page. Lost passphrases cannot be recovered by anyone.
Encrypted backups
Backup files are encrypted the same way with a separate passphrase you choose, so a leaked file is useless without it.
No passwords, no forwarding
We never ask for your passwords to other services, and we never transmit, forward or intercept your codes.
Honest limits
Your vault is only as safe as your device. Malware or someone with access to your unlocked browser could see codes. Keep your device updated and lock the vault when done.
Read our full Privacy Policy.