Effective date: 2026-10-14 · 한국어

Popout Authenticator is a free, open-source browser extension that generates two-factor (2FA) one-time codes. The developer runs no server for it. The extension contains no analytics, advertising, crash reporting, or tracking code, and the developer never receives your accounts, secrets, codes, or browsing data.

• Accounts and secrets are kept in the browser's extension storage as an encrypted vault (AES-256-GCM).
• If you set a password, the vault key is protected by your password (Argon2id). A recovery code and a passkey can also unlock it.
• Without a password, the vault is still encrypted, but its key is stored next to it. Anyone with access to your browser profile could read it. Set a password to protect your accounts.
• Recovery snapshots of earlier vault versions are kept in the extension's local database (the latest 30, plus the most recent one for each of the last 30 days) so you can undo mistakes.
• Settings, site buttons, and site usage hints (which account you used on which site) are stored locally and are not synced.
• Backup and export files are saved only where you choose. Plain-text exports are not protected; keep them safe or use the encrypted backup format.

Data leaves your device only in the cases below, and never to the developer.

1. Browser sync (on by default, runs only with a password lock). On Chrome, Edge, and Firefox, accounts can sync between your devices through the browser's own sync service (storage.sync), operated by your browser vendor under its privacy policy.
2. Sync is on by default but runs only after you set a password lock. Each account (secret, issuer, name, notes, group, and site addresses) is then encrypted with your vault key before upload.
3. Without a lock, nothing is synced unless you explicitly allow unencrypted sync after a warning. In that case the key is uploaded too, so the synced data is effectively unprotected.
4. So that devices can merge changes and unlock, these are stored unencrypted: random account IDs, timestamps, deletion records, the lock type, a key fingerprint, and the vault key wrapped by your password, recovery code, and passkeys (with passkey credential IDs).
5. You can turn sync off and delete the synced data in Settings → Sync. Safari builds do not offer sync. An organization's administrator can turn sync on or off by policy.
6. Clock check (on by default, can be turned off). Codes depend on an accurate clock. The extension asks time.akamai.com, timeapi.io, and cloudflare.com for the current time with a plain request that contains no account data. The result is cached (normally for 6 hours). Like any web request, these services can see your IP address. Turn it off in Settings → Clock check.
7. Code share links (only when you create one). A share link contains the service and account name and the codes for the period you choose (5 to 60 minutes), never the secret.
8. The data is encrypted inside the part of the link after #, which browsers do not send to the server. The page at elitekid.github.io/popout-authenticator/share/ decodes it in the recipient's browser and makes no further requests. GitHub Pages serves that page and can see the visitor's IP address, as with any website.
9. Anyone who has the link (and the password, if you set one) can see the codes until they expire. A link cannot be revoked early, so share it only with people you trust.
10. Filling codes into websites (only on sites you allow). Site access is optional and requested only for the sites involved: the current site when you fill from the separate window or side panel, the sites you enter for an account's field button (including subdomains), or a fixed list of known services when you turn on automatic recognition. The extension never asks for all sites, and you can remove access in the browser's extension settings. Site addresses you link to accounts are kept inside the encrypted vault; for accounts with field buttons, they are also stored unencrypted in local extension storage so the buttons work while the vault is locked.
11. Feedback link. "Send feedback" opens the GitHub issues page (or an address set by your administrator). GitHub's privacy policy applies there.

• Clipboard: copying a code writes it to the clipboard. If you turn on "clear clipboard after copy", the extension asks for clipboard read access and only checks whether the clipboard still holds the code it copied (compared by hash) before clearing it.
• Camera and screen capture for QR codes: used only when you start a scan. Images are decoded locally and are not stored or sent anywhere.
• Tabs (optional): lets the separate window and side panel suggest the account for the current site. The address is used only on your device.

The Firefox build declares authentication information, personally identifying information (account names, often email addresses), and browsing activity (site addresses linked to accounts) as optional data collection, because browser sync can transmit them. Firefox asks for your permission when you turn sync on, and sync does not run in Firefox without it. Nothing is required to install the extension.


Changes to this policy are published in this file with a new effective date. Questions: <https://github.com/elitekid/popout-authenticator/issues>