Privacy policy

Cifra is designed so that the server can't read your TOTP secrets.

Data we keep

Your email address and when it was verified.
An Argon2id hash of the authentication key derived from your master password (the password never leaves your device).
Your TOTP secrets, encrypted with AES-256-GCM on your device; the display name and the linked domains are kept in clear text so the extension can recognize the site.
If you turn on two-factor authentication: the authenticator-app seed (encrypted with a server key), your passkeys' public keys and hashes of your backup codes. If you link a Google account: its identifier and email address.
Active sessions (device label, user agent, sign-in dates) and a log of security events (sign-ins, password changes) with IP address.

No tracking, analytics or ads in the extension or on this site. We don't sell or share data.

You can delete your account from the extension: after the email confirmation all data is permanently deleted.