Security

3FA is built so that even we can't read your secrets. Here's exactly how, and how to report a problem.

Cryptography

• At rest: OTP seeds are encrypted with XChaCha20-Poly1305 under a data key that is wrapped by an Argon2id key derived from your passcode, and sealed to the platform Secure Enclave / TPM.
• In transit / sync: the entire vault is end-to-end encrypted on your device before upload. The server stores only ciphertext and a version vector — it has no key capable of decrypting it (zero-knowledge).
• Standards: codes follow RFC 6238 (TOTP) and RFC 4226 (HOTP), verified against the official RFC test vectors.
• Biometrics: fingerprint and voiceprint data never leave your machine.

Access control

• Multi-factor unlock (passcode, biometric, passkey, voice); configure 2FA or 3FA to taste.
• Auto-lock after 90 seconds idle; extending up to 5 minutes requires a second, distinct factor.
• Per-device sync tokens that can be revoked individually.

What we can't protect against

No client software can defend a fully compromised operating system (e.g. a kernel-level keylogger active while you unlock) or a coerced user. 3FA limits blast radius — it does not claim to be magic.

Reporting a vulnerability

Email security@threefa.app. Please include reproduction steps and avoid accessing other users' data. We aim to acknowledge reports within 72 hours. See our machine-readable policy at/.well-known/security.txt.