The short answers, without the hand-waving.

Authier is an open-source password manager for login credentials and time-based one-time password (TOTP) codes. It runs through browser extensions and a web vault.

Yes, you can use Authier for work accounts. Authier does not currently advertise the mature organization administration, policy enforcement, sharing, or enterprise support offered by larger password managers, so evaluate those requirements before adopting it for a team.

Authier encrypts vault items in the client before synchronization. The API stores encrypted payloads rather than plaintext credentials or TOTP seeds.

The current shared cryptography implementation derives a key with PBKDF2 using SHA-512 and 600,000 iterations, then encrypts vault data with AES-256-GCM.

The account policy can allow immediate enrollment, require approval from any trusted device, or require the master device. When approval is enabled, a new browser stays pending until the selected device accepts it before vault synchronization begins.

It reduces factor separation, but a TOTP code can still stop password-only attacks. Authier lets you disable TOTP synchronization on selected devices. For high-impact accounts, a separate authenticator, passkey, or hardware security key may better match your threat model.

It is a convenience-versus-separation decision, not an absolute yes or no. Authier encrypts both kinds of secret before synchronization and can require approval from an existing device for enrollment. A compromised unlocked client could still expose both, so keep independent recovery options and separate high-impact factors when appropriate.

Authier has official listings for Google Chrome, Mozilla Firefox, and Microsoft Edge. The Firefox add-on is also available for Firefox on Android.

Authier has a free tier. Optional monthly capacity packs add more credential or TOTP storage without changing the core encryption and device-approval features.

Authier has not yet published an independent third-party security audit. Its source is public, but open source is not a substitute for a professional audit or a long operational history.

Yes. Splitting secrets can reduce the impact of one vault compromise, but it also adds operational complexity. Browser extensions can compete for the same fields, so you may need to disable autofill for one extension on specific sites.

Change the vault password from the master device. Authier logs out the other devices, and you then sign in and approve them again; the change is not silently applied to every unlocked client.

Yes. Authier uses a shared corpus of non-secret form metadata—such as the page URL without its query string, host, field type, and CSS selector—to improve autofill. The extension includes controls to remove matching records; newer free accounts wait one week before deletion is enabled. Password values and TOTP seeds are not part of that public record.

The browser vault can import login credentials from CSV and TOTP records from Authy-style JSON. It can export login credentials and TOTP records to CSV. Exported files are sensitive plaintext backups, so encrypt or delete them promptly.

The previous website listed native desktop and Android apps as a Q4 2023 roadmap item, linked an early iOS build, and recommended Kiwi Browser. Those statements are historical. Kiwi is now archived; the current public downloads are Chrome, Firefox, Edge, and Firefox for Android.

Use the responsible-disclosure instructions in the SECURITY.md file in the public Authier GitHub repository. It includes the project disclosure policy and PGP key fingerprint.