Can I trust Bitwarden Authenticator?
This app did not meet one of the trust checks that applied to it, with no red flags.
- Best for
- Managing two-factor codes without cloud dependency
- What it means for you
- Authentication secrets and TOTP codes remain on the device. The build includes Firebase Crashlytics for crash reporting and Firebase Cloud Messaging for push notifications; no advertising or behavioral analytics SDKs are present. Cross-app data access is limited to other Bitwarden apps from the same developer.
- Main concern
- TOTP 2FA secrets stored unencrypted in SQLite — root access exposes all enrolled accounts
- The developer's description
- Bitwarden Authenticator generates verification codes for two-factor authentication using industry-standard TOTP. Simple, intuitive interface works with any website or application that uses time-based one-time passwords. From Bitwarden, the password manager trusted by millions.
- Third-party services
- 3
- Findings rated low or higher
- 3
Open on Google PlayOpens the app's listing on Google Play in a new tab.
Full findings
Open this scan in your dashboardThe account that ran this scan sees every finding and the Rescan button there.
Trust checks
Secure by Design
One criterion not metSecurity gaps detected
Why this result
This check looks for security issues at high severity or above in the code of this build, and at least one was recorded. Issues of this kind include a credential or token another app on the device can reach, sensitive data stored without protection, and network paths that expose information in transit.
Data Minimization
StrongTracking done right
Why this result
The check looks at analytics and attribution code for companies other than the developer: the data it reads, the companies named in code as recipients, and whether a consent step runs before that code. In this build, either no such code was recorded, or a consent step runs before it and the app's own disclosures describe the collection.
Firebase Crashlytics, a crash reporting service run by Google, is active from the app's very first launch before the user has seen or agreed to any disclosure. A toggle in the app's settings lets the user turn it off, but the app includes code to send crash data including device details and stack traces before that choice is offered. On the other hand, the app contains no advertising, behavioral analytics, or attribution services, and the advertising identifier is never accessed.
Manifest Mismatch
StrongEverything visible
Why this result
The check compares the app's privacy disclosures against what the code does: the data categories collected, the companies named in code as their recipients, and the identifiers attached to each. The comparison covers the store listing, the in-app privacy text and any privacy manifest shipped in the build. Every claim compared matched the code here.
The app's published data safety label covers crash reporting under app performance data, which matches the only external data flow found in the code. No advertising, behavioral tracking, or attribution services are present, so there are no undisclosed data collections to flag. The cross-app account sync with the Bitwarden Password Manager is a same-developer integration between Bitwarden's own apps.
User Control
StrongNo lock-in
Why this result
The check looks for a way to export the data an account has accumulated and a way to delete the account itself. In this build, either both were found, or the app has no account of its own and keeps its data on the device. For an app without an account, the developer has no server-side copy to export or delete, and deleting the app removes the data in its own storage.
Authenticator secrets and account data are stored on the device. Users who link the app to the Bitwarden Password Manager can export their vault data through that app's standard export tools. There are no proprietary data formats that would trap a user, no server-side account holding data that cannot be retrieved, and no artificial barriers to switching to a different authenticator.
Strengths
- No advertising networks or third-party analytics SDKs are present
- TOTP codes are generated entirely on the device and authentication secrets are never transmitted to any server
- Cross-app data access is restricted to Bitwarden's own apps (same developer) via a certificate-verified encrypted bridge, with no third-party access
- Cryptographic keys for the IPC bridge and biometric unlock are stored in encrypted preferences that are excluded from device backups
- Biometric unlock keys are protected by Android KeyStore and invalidated if new biometrics are enrolled
- All network connections use the standard system CA trust chain with no certificate validation bypass
- No WebView is used anywhere — OAuth flows use Custom Tabs, eliminating the entire class of JavaScript bridge risks
What the app contains
3 services
Third-party services the scan names in the build:
- Firebase Cloud Messaging
- Firebase Crashlytics
- Firebase Installations
Libraries
| Library | Version | Advisory |
|---|---|---|
| ExoPlayer / media3 | not recorded | none confirmed |
| Room | not recorded | none confirmed |
| Glide | not recorded | none confirmed |
| Datatransport | not recorded | none confirmed |
| Google Sign-In | 12451000 | none confirmed |
| Google Play Services | 12451000 | none confirmed |
| Gson | not recorded | none confirmed |
| Google Tink | not recorded | none confirmed |
| Firebase | 12451000 | none confirmed |
| Protocol Buffers | not recorded | none confirmed |
Show all 15 librariesShow fewer
Changes since the previous scan
- Version 2026.7.0 (versionCode 1805), score 49.
- Score 75 before, 49 after.
- Version 2026.1.1 (Build 1243) before, 2026.7.0 (versionCode 1805) after.
- Score change since version 2026.1.1 (Build 1243): -26 points.
- Since the previous scan: 11 findings added, 5 removed.
- Version 2026.1.1 (Build 1243), score 75.
- First public scan of this app.
Method and limits
Static analysis: the decompiled code, manifest and resources of this build, read file by file. Network traffic at run time is established by a capture of the running app.
- Build SHA-256
- fa81bc6bc9511c662486b9ae9a8b33ab78c5cca134db4b96846c8f777727b7ff
- Rule pack
- citt-ruleset-2026-08-v1
- Files decompiled
- 11,264
- Scan date
- 13 August 2026
Corrections
No correction is published for this app.
Developer response
No response is published for this app.
Report an error Opens an email to [email protected] that names this app and this scan.