New browser requests access
The browser creates its identity and starts a pending challenge.
Security architecture
Security claims you can inspect.
Authier encrypts vault contents before they leave your browser and can put approved devices into the decision about who may join your account. This page explains both the design and its limits.
Encryption flow
Plaintext stays on the client.
Your master password is used locally to derive an encryption key. Vault items are encrypted before synchronization, so the API stores encrypted payloads rather than readable credentials or TOTP seeds.
- 01
Key derivation
PBKDF2 with SHA-512 and 600,000 iterations derives a key from the master password and a per-account salt.
- 02
Authenticated encryption
AES-256-GCM encrypts vault items with a fresh initialization vector before they are sent to the API.
- 03
Encrypted synchronization
The server stores and synchronizes ciphertext. Approved clients decrypt it locally after the vault is unlocked.
Device-aware access
Approval can keep a new device outside the vault.
When the account policy requires approval, knowing an account email and master password is not enough to silently enroll an unfamiliar client. The device must request access, and an approved device reviews that request. Accounts can also choose immediate enrollment, which trades this extra check for convenience.
Trusted device reviews it
An existing approved device can accept or reject the new login.
Encrypted vault becomes available
Only after approval does the client complete enrollment and sync.
Transparent limitations
Open source is evidence—not an audit.
Authier has not yet published an independent third-party security audit. The project is actively developed and has a much shorter operational history than established password managers.
For accounts with an unusually high impact—such as banking, cryptocurrency custody, or administrative access—you should evaluate that maturity gap as part of your own threat model.
The source is public so researchers can inspect the implementation and report vulnerabilities responsibly. No software can promise absolute security.
Public implementation
Application and server code, history, tests, and issues are available in the public repository.
Revocable devices
Review devices connected to the account and remove access when a device is lost or retired.
Responsible disclosure
Security researchers can follow the published disclosure process and use the project PGP key.
Evaluate it yourself
Read the code before you trust the claims.
Authier is developed in public under the GNU Affero General Public License.