Security

This page describes our approach in plain words. It is not a certification and not a guarantee, and it covers the app as it is today.

Our approach

• Keep it on the phone. The app has no accounts and no internet permission, so there is no server of ours holding your codes and nothing for the app to send out.
• Encrypt what is stored. Your codes are stored encrypted, with a key kept in your phone’s hardware-protected key storage on phones that have it, and unlocked with your fingerprint, face or screen lock.
• Backups you hold. Backups are files protected by a passphrase only you know. We cannot read them or reset the passphrase.
• Refuse rather than guess. If something does not look right, such as a damaged vault, a tampered backup or a malformed QR code, the app refuses and tells you instead of carrying on with a guess.
• Small and checked. We keep the app’s dependencies few, and our release checks are automated, including one that fails the build if the app ever asks for internet access.

What it helps protect against

• Someone learning your password: they would also need a current code from your phone.
• Someone copying the app’s data off a locked phone: it is encrypted, and the key stays in the phone’s protected storage.
• Someone finding your backup file: it is encrypted, so a strong passphrase matters.
• Ordinary screenshots, screen recordings and recent-apps previews of the app.

What it does not protect against

• Fake sign-in pages. A one-time code can be typed into a convincing fake site and passed on by an attacker in real time. Codes help if your password is stolen; they do not stop phishing. Passkeys, which we plan to add, also protect you from fake sign-in pages.
• A compromised phone. Malware, a rooted device, or an accessibility tool you have allowed can see what is on the screen while the app is unlocked. The app warns you if it notices some signs of this, but it cannot make a compromised phone safe.
• Someone who has your phone and knows its PIN.
• A weak backup passphrase, which can be guessed.
• Scanning a QR code you did not ask for. Only scan codes that a site you are setting up shows you.

The app has not been through an independent third-party security audit.

Report a vulnerability

If you find a security problem, please email security@bvauth.com with enough detail to reproduce it. We will acknowledge your report and keep you updated, and we ask that you give us reasonable time to fix the problem before sharing details publicly. Please do not access anyone else’s data or disrupt any service while testing. These details are also in our security.txt.