AuthBox — Privacy Policy
Effective 14 September 2026 · Last updated 30 September 2026
AuthBox does not collect any personal information. It has no user accounts, no servers, no analytics, no telemetry, no advertising and no crash reporting. Everything you put into AuthBox stays on your own computer, encrypted. The developer receives nothing about you or your use of the app, because there is nowhere for it to be sent.
What AuthBox stores, and where
AuthBox is an offline authenticator app. It stores the following on your device only:
- The secret keys for your two-factor authentication accounts, along with the account name, issuer and settings (algorithm, digit count, period).
- Anything you choose to add to an account's “Auth info”: notes, security questions and answers, phone numbers, recovery or alternative email addresses, recovery keys and seed phrases, and any other label/value details you enter.
All of that is held in an encrypted vault file, encrypted at rest with AES-256-GCM under a key derived from your master password using Argon2id. Your master password is never stored anywhere in any form — not on disk, not in a configuration file, not in a log. It exists in memory only for the moment it takes to derive the encryption key, and a derived key cannot be reversed back into the password.
There is no password recovery and no backdoor. If you forget your master password, the vault cannot be decrypted by anyone, including the developer.
Alongside the vault, AuthBox writes a few plain, unencrypted files that contain no secrets and no personal information:
| File | What it holds |
|---|---|
last_profile.txt | The name of the profile you last opened. |
deletion_log.json | Which profiles were deleted and when, and whether the deletion was authorised by that profile's own password or another's. Never a password, never account data. |
time_sync.json | A clock-correction offset, in seconds. |
ui_settings.json | Your light/dark theme preference. |
capsule_seeded.json | A marker noting that a portable copy has already been set up on this machine. |
If you explicitly export a backup QR code, AuthBox writes a plain image file to the location you choose. That image encodes the account's secret, so it should be stored as carefully as a password. Saving it is always an action you take deliberately.
Network use
AuthBox works entirely offline. It has exactly one optional network feature.
Sync time. If you click “Sync time”, AuthBox makes a single HTTPS
request to https://www.google.com and reads the standard Date
header from the response, to detect and correct a drifting system clock. Time-based
codes are only valid if your clock is accurate, so this exists to fix codes that would
otherwise be rejected.
No AuthBox data is transmitted in that request — not your accounts, not your secrets, not any identifier. As with any request to any website, the server you contact will see your IP address and ordinary request metadata, and its operator handles that under its own privacy policy. The request is never made unless you click the button.
Apart from that, AuthBox makes no network connections of any kind. It does not check for updates, report crashes, or contact the developer.
Information the developer collects
None. AuthBox has no server component and no account system. The developer has no ability to see your accounts, your secrets, your master password, your usage, or even whether you use the app at all.
If you contact the developer for support, you will be sharing whatever you choose to include in that message. Please do not include secret keys, recovery phrases or your master password in a support request — they are never needed to help you.
The “Report a problem” and “Send feedback” options in AuthBox's ⋯ menu prepare such a message for you. They show you the complete text first and open it in your own email program — AuthBox itself sends nothing, and nothing is sent unless you send it. The prepared message contains only the AuthBox version and build, how it was installed, and your Windows version. It contains nothing from your vault, no file paths and no computer name, and you can edit or remove any of it before sending.
Sharing with third parties
AuthBox does not share, sell, rent or transmit your information to anyone, because it never collects it in the first place.
Permissions AuthBox uses on your device
- Screen capture, when you use “Scan screen now” to import a QR code shown on your own display. The captured region is held in memory only, decoded, and discarded. It is never written to disk or sent anywhere.
- Global keyboard shortcuts, if you assign a hotkey to an account, so a code can be copied without opening the window. AuthBox listens only for the specific shortcuts you configure; it does not record or transmit what you type.
- Clipboard, to place a code on it when you copy one.
- Startup registry entry
(
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run), only if you turn on “Launch at startup”. This is the same setting Windows' own Task Manager “Startup apps” tab controls, and turning it off in either place removes it.
Your control over your data
Your data is in files on your own computer, and you can inspect, move, back up or delete them at any time.
- To see where they are, use Create portable copy… or check your user profile's AuthBox folder.
- To delete everything from inside the app, use Remove all AuthBox data from this PC in Settings. Files you placed in the AuthBox folder yourself are never touched.
- To delete everything by hand, uninstall AuthBox and delete the vault files
(
*.authbox) and the small plaintext files listed above. Uninstalling alone deliberately does not delete your vaults, so that reinstalling or upgrading never destroys your accounts.
Because AuthBox holds no data about you, there is nothing for the developer to provide, correct or erase on request. Rights such as access, rectification and erasure under laws like the GDPR are exercised directly by you, on your own device.
Children
AuthBox is a general-purpose security utility. It is not directed at children and does not knowingly collect information from anyone, including children.
Changes to this policy
If this policy changes, the updated version will be published at this same address with a new “last updated” date. Material changes will be noted in the app's release notes.
Contact
Common questions are answered on the support page.