How Your Codes Are Protected¶
This page explains, without jargon, what stands between your codes and anyone else. If you only remember one thing: the app is built so that Pebble IT could not read your codes even if it wanted to.
Where the keys live¶
Each account's setup key is stored in your iPhone's Keychain, the same protected storage iOS uses for your Wi-Fi passwords and saved logins. The Keychain is encrypted, tied to your phone's passcode, and unreadable while the phone is locked. A backup of the phone made by iTunes or iCloud can't reveal the keys either.
If you chose to sync, a copy also lives in your iCloud Keychain, which Apple encrypts end to end so that only your own signed-in devices can open it. Apple can't read it, and neither can Pebble IT.
Face ID or Touch ID, every time¶
Storing the keys safely is half of it. Showing a code is the other half, and the app asks Face ID or Touch ID before showing any code, every single time. That is why a friend, a colleague or a thief holding your unlocked phone still can't sign in as you. There is no passcode fallback for a code, on purpose.
Locks and timeouts¶
- The launch lock (on unless you turn it off) hides even your account names behind Face ID or Touch ID whenever the app opens or comes back to the front.
- The Idle Timeout closes whatever you left open after two minutes untouched and covers the app with its splash screen.
- The privacy cover replaces the app with its logo the instant you switch away, lock the phone or open Control Center, so a code is never captured in the App Switcher.
See Face ID at Launch and the Idle Timeout for the details.
Copying a code¶
When you tap a code to copy it, the copy lives on the clipboard for 30 seconds and then disappears, and it never travels to your other devices through Universal Clipboard. A code is only useful for about half a minute anyway.
Backups¶
A backup's images are encrypted with a 30-character recovery key that has 136 bits of randomness, and the key is deliberately slow to try, so guessing is hopeless even for a future quantum computer. The images themselves show only a date, how many accounts and images there are, and account numbers; never a name, a key or a code. Your Recovery Key explains how to keep the key.
The Apple Watch¶
Accounts reach the Watch over the encrypted connection between the iPhone and its own paired Watch, never through iCloud or the internet. On the Watch they're stored in the Watch's Keychain, behind the Watch's passcode, and turning Device Sync off, or unpairing the Watch, removes them.
No server, no account, no tracking¶
Private Authenticator has no account to sign into and no server that holds anything of yours. It doesn't collect analytics and shows no adverts. The only two things it ever opens on the internet are the Pebble IT website and this documentation, and only when you tap those links. The Privacy Policy puts this in writing.
Continue to What the App Never Does.