The Autothenticator vault: encryption and unlocking
What's stored, and how
- Encryption: every account is encrypted with its own key (AES-256-GCM). Those keys are wrapped by the vault key: 256 random bits, made on the person's first device.
- The vault key isn't made from anything the person types, so a stolen copy of the data has nothing to guess.
- The passphrase (where one is used) is stretched with Argon2id (64 MB of memory, 3 passes) together with a random device secret. The device secret is kept on the device and printed on the recovery kit. A stolen vault file alone can't be attacked offline, even with a weak passphrase.
- New passphrases need at least 10 characters. They're checked for strength, and against the Have I Been Pwned list of leaked passwords. The check sends only a short fragment of a hash, never the passphrase.
- While unlocked, keys stay only in memory: in a browser, in session memory that's never written to disk and is cleared when the browser closes. Pages never receive a key or a secret, only the code for the matching box.
- What sync sees: sync stores only encrypted data. It sees ids, sizes and timestamps, never names, sites or secrets.
Unlocking
Unlocking always happens on the device itself, and works offline.
| Device | Usual unlock | Fallback |
|---|---|---|
| Phone, tablet, Mac | Fingerprint, face (Face ID, Touch ID) or the device PIN, through the device's secure hardware (Android Keystore, Secure Enclave) | Passphrase |
| Browser on a computer with Windows Hello or Touch ID | Windows Hello, Touch ID or a security key (a passkey feature called PRF) | Passphrase |
| Synced browser without that | Approve on your phone: the phone sends the key for this browser session only, and nothing is stored | Passphrase |
| Free user with neither | Passphrase | Recovery kit |
- The passphrase every so often: even with biometrics set up, the apps ask for the passphrase every 14 days by default, so it isn't forgotten. This can be changed or turned off.
- After changing fingerprints or faces on a phone, the biometric unlock stops working (that's how the hardware works), and the passphrase is needed once to set it up again.
- Older Windows Hello set-ups: on Windows before the February 2026 update, Windows Hello can't give the extension its key, so it falls back. After updating Windows, set Windows Hello up again in the extension's settings.
- Quick-unlock PIN (browser, optional): after a full unlock, a short PIN reopens the vault after auto-lock, until the browser closes. Five wrong tries clear it.
Auto-lock
- After 15 minutes without use by default (1 minute to 8 hours).
- When the computer locks or sleeps (browser, on by default), and when the browser closes.
- Lock now from the popup or with Alt+Shift+L.
- Organisations can set a maximum.
More than one account in one app
One app can hold a personal account and work accounts side by side. Each is a separate vault, synced to its own Winfrasoft account.
- One unlock opens them all, unless a work account's policy needs biometrics and the app was opened with the passphrase.
- Codes are listed together, each labelled with its account.
- The organisation can't see the personal account, and its policy never applies to it.
- Some organisations require their own install for work accounts. People then use an Android work profile or a work browser profile.