Designed around
local control.

ZeroOTP requires passcode setup before vault use, so authenticator secrets are protected on your device and encrypted by the client before sync in the normal app flow.

Passcode-Derived Encryption

Your app passcode is used to derive encryption material on your device. ZeroOTP uses PBKDF2-HMAC-SHA256 with a per-user salt and 600,000 iterations, then uses the derived key for OTP secret encryption and unlock operations.

AES-256-GCM For Synced Secrets

OTP secrets are encrypted client-side using AES-256-GCM before sync. The backend stores the encrypted value it receives and does not need your passcode to perform sync.

Secure Key Storage

Encryption material used by the app is stored using secure key storage provided by the operating system or device platform where available. The exact storage mechanism may differ across mobile, desktop, and web environments.

Biometric Access Gate

If you enable Face ID, Touch ID, or fingerprint unlock, the biometric prompt acts as a local access gate to the app. Biometrics do not replace your passcode-derived encryption model.

Zero-Knowledge Boundary

Because vault use requires passcode setup, OTP secrets are passcode-encrypted by the client before sync in the normal app flow. The developer and backend cannot decrypt those secrets without the passcode-derived key from your device. The server still stores account data needed for sync and access, such as email, device/session records, categories, and encrypted OTP record data.

Local Cache Protection

The app also keeps an encrypted local cache so records can load quickly. This cache uses a separate app-managed key stored through platform secure storage and is distinct from the AES-256-GCM encryption used for passcode-protected synced OTP secrets.

Offline Code Generation

TOTP codes are generated on your device. Once your vault data is available locally, generating current codes does not require an internet connection.

Exports Are Plaintext

Backup export files are intentionally portable and contain plaintext OTP secrets. Treat exported files like passwords: store them securely, avoid sending them through untrusted channels, and delete them when no longer needed.

No Cloud Transmission Of Plain Secrets

ZeroOTP requires passcode setup before vault use and encrypts OTP secrets before creating or syncing records. If the app ever shows a re-encryption or migration prompt, complete it before relying on sync for sensitive records.

Security Contact

To report a security issue, contact [email protected]. Please avoid including live OTP secrets, passwords, or recovery codes in your message.