2FA KeyringSummary
Your two-factor keys, account names, passphrase and codes are handled only inside your browser, on your device. They're never sent to us or anyone else. There are no accounts, cookies, analytics, ads or third-party scripts.
Who we are
2FA Keyring is a free, open-source project maintained by its author on GitHub at github.com/estuty/2FA-Keyring. In this policy, "we" and "us" refer to the project and its maintainer, and "the app" refers to the 2FA Keyring web app at /app/.
The website is made of static files. We run no servers, databases or back-end code of our own. A hosting provider serves the files (see What the host can see).
What we collect
Nothing. Specifically, we don't collect:
- your two-factor setup keys, codes, service names or account names
- your vault passphrase
- names, email addresses, phone numbers or any account details, because there are no accounts
- usage statistics, analytics, crash reports or device fingerprints
The app is technically prevented from sending data: its Content Security Policy blocks network connections (connect-src 'none'), and it loads no code from any other website. The security page explains how this works and how to check it yourself.
What stays on your device
The app saves two items in your browser's local storage, on your device only:
| Item | Contents | Protection |
|---|---|---|
| Your vault | Your keys, with the service and account names you entered | Encrypted with AES-256-GCM using a key derived from your passphrase. Without the passphrase it's unreadable. |
| Settings | Auto-lock time, the "lock when I switch tabs" option and the date of your last backup | Not encrypted. Contains nothing personal. |
While the vault is unlocked, the decrypted keys exist only in the page's memory. They're cleared when the vault locks or the page closes. We can't see, access or recover anything stored on your device.
What the host can see
Like every website, this one has to be delivered by a hosting provider. 2fa-keyring.com is hosted by Cloudflare. When your browser requests the site's files, Cloudflare receives standard request information:
- your IP address
- your browser and operating system type (the user agent)
- the date and time, and which files were requested
These requests contain nothing you type or store in the app. Cloudflare handles this information under the Cloudflare Privacy Policy. The source code is hosted on GitHub, which applies the GitHub General Privacy Statement when you visit the repository. We don't use this information to identify, profile or track visitors, and we don't combine it with any other data. A hosting dashboard may show the maintainer overall traffic figures, such as request counts.
Cookies and tracking
The website and app set no cookies. They use no analytics, advertising, social media widgets, tracking pixels or fingerprinting. Local storage is used only for your encrypted vault and settings, as described above, and never for tracking.
Because there are no non-essential cookies, there's no cookie banner to accept.
Data you move yourself
Some actions in the app put data under your control outside the app:
- Backups. An exported backup is a file or text that you save or copy. It stays encrypted with your passphrase. Where you keep it is up to you.
- Copied codes. Copying a code places it on your device's clipboard. Clipboard history or cloud clipboard sync on your device may keep it, though codes expire within their time period.
- Showing a setup key. When you choose to reveal a key, it's displayed on your screen only.
Your browser's own features
Your browser and operating system are separate from 2FA Keyring and have their own privacy settings. To reduce what they could send elsewhere, the app turns off spell check, autocorrect and page translation for its fields. If your browser offers to save your vault passphrase in a password manager that syncs to an online account, that passphrase is then protected by that account. Decide whether that's what you want.
Your choices and rights
Because we hold no personal data about you, there's nothing for us to access, correct, export or delete on request. You stay in control of everything the app stores:
- Delete everything: use Settings → Erase vault in the app, or clear this site's data in your browser settings.
- Take your data elsewhere: use Backup in the app. You can also reveal any key's setup key and add it to another authenticator.
For information the hosting provider holds about requests to the site, such as server logs, contact that provider using the links in What the host can see.
Children
2FA Keyring isn't directed at children and collects no data from anyone, including children.
Changes to this policy
If this policy changes, the new version will be published on this page with a new effective date. Every past version is kept in the project's public history on GitHub, so you can see exactly what changed and when. We won't change the app to collect personal data without saying so clearly on this page first.
Contact
For questions about this policy, open an issue on the project's GitHub page. Please don't include setup keys, backups or other secrets in an issue. To report a security problem privately, use GitHub's private vulnerability reporting.