Frequently asked

Almost nothing. The protocol the phone speaks is a compact binary format, typically a few hundred bytes per screen, encrypted in transit like everything else. A typical day of use is comfortably under 1 MB.

Great for everyday accounts; assess your risk tolerance for your most sensitive ones. Codes from a paired phone travel over a channel we encrypt ourselves using ChaCha20-Poly1305, the same cipher TLS 1.3 uses because 2003-2013 phones can't validate modern security certificates. That keeps every request private and tamper-proof, but it can't prove the server's identity the way a browser's padlock does. So we treat these codes as medium-security: ideal for logins where a second factor is a sensible extra, less suited to high-value financial or administrative accounts. Whatever you protect with them, keep the backup codes the other service gave you somewhere safe. The full reasoning is on the how it works page.

No, none of it. We don't run ads, sell or share your data, profile you, or use your data to train AI models. The subscription is the whole business model, which is exactly what lets that answer stay simple. The only thing we keep is a handful of anonymous counters (like how many phones pair, or which features get clicked) that aren't tied to your account, and every one is listed on the privacy page.

You can pair one phone on the free tier, and up to six phones on the subscription tier, and they all sit under your one account. Pair each separately, each shows its own six-digit code, and your dashboard lists them so you can rename or unpair any single phone without touching the others. One thing to know: every paired phone shares your one account, so they all see the same Authenticator codes, Habits, Tasks, Events, and Weather. That's perfect for your own spare phones or a shared household view, but it isn't a separate private account per person.

In the web app: Account → Delete Account. It's immediate and removes your account and all its data, along with every paired device, in one step. Two things worth knowing first: if you have an active paid subscription you'll need to cancel it before deletion unlocks (this keeps you from losing your account while a renewal is still being charged). Before you go, you should export any Authenticator account seeds from the Authenticator feature page as we can't recover those for you once your account has been deleted.