Privacy policy

Last updated: 30 October 2026

In short: AuthRing stores everything on your own computer, encrypted with your master password. It has no servers and no accounts, and it does not collect analytics. Your data is never sent to us or to anyone else.

What AuthRing stores

Only what you put in your vault, or ask AuthRing to save:

Logins: names, website addresses, usernames, passwords and notes.
Two-factor (TOTP) secrets, and the page fields you link them to.
Passkeys: the private keys and account details that websites register.
Your AuthRing settings.

Where it is stored and how it is protected

The vault is encrypted on your computer with AES-256-GCM, using a key derived from your master password with Argon2id. It is saved in the browser's extension storage, in the browser profile where AuthRing is installed.
Optional shared storage: if you turn on sharing between browser profiles, the same encrypted vault is saved in a file in your home folder (~/.local/share/authring/vault.json on Linux), through a small helper program you install yourself. The file is never decrypted outside the extension.
While the vault is unlocked, its key is kept in memory only, and is cleared when the vault locks. That happens after a period of inactivity, when your computer locks, and when the browser closes.
Your master password and recovery key are never stored.
Backups are encrypted files that you choose to save yourself.

What AuthRing sends over the network

Nothing. AuthRing makes no network requests of its own: no telemetry, no analytics, no crash reports, no syncing to a server. Website icons come from the browser's own local icon cache.

How AuthRing uses web pages

To detect login, passkey and verification-code fields, AuthRing reads the structure of the pages you visit inside your browser. Your browsing is not recorded, and page contents are not stored.
When you submit a login form, AuthRing briefly keeps the username and password in memory, for up to two minutes, so it can ask whether to save them. If you don't choose Save, they are discarded.
Passwords, codes and passkeys are only given to pages whose address matches the saved item. For passkeys, the site's identity comes from the browser, not from the page.

Camera, screen and clipboard

Camera: used only while you scan a 2FA QR code with your webcam. Frames are processed on your computer and discarded.
Screenshot of the current tab: taken only when you click “Scan QR on this page”, processed on your computer to find the code, then discarded.
Clipboard: written only when you click a copy button.

Permissions

Permission	Why AuthRing needs it
Read and change data on websites	Find login, passkey and code fields; fill them; offer to save logins; answer passkey requests.
Storage	Keep the encrypted vault and your settings.
Tabs, web navigation	Know which site the current tab and its frames belong to, so only matching logins are offered and filled.
Alarms, idle	Lock the vault after inactivity and when your computer locks.
Favicon	Show site icons from the browser's local cache.
Native messaging	Talk to the optional helper that stores a vault shared between browser profiles. Unused unless you install the helper.
Privacy settings (optional)	Only if you ask: turn off the browser's own password saving and form autofill.
Manage extensions (optional)	Only if you ask: list other password-manager extensions and turn off the ones you choose.

Sharing and selling

AuthRing does not sell, rent, share or transfer your data to anyone, and does not use it for advertising, credit decisions or anything else besides the features above.

Deleting your data

In AuthRing, go to Settings → Delete vault. Removing the extension also deletes the data it stored in your browser.
If you used shared storage, also delete ~/.local/share/authring/.

Children

AuthRing is not directed at children and does not knowingly process children's data.

Changes

If this policy changes, the new version will be published on this page with a new date.

Contact

Questions about privacy: dev@codin.pro