Skip to content
Menu

Can I trust Drop Authenticator?

NOT ASSESSED 92 Android Version 1.2.11 (versionCode 102011) Scanned build downloaded: Store version released: Last checked: com.pixplicity.auth Scanned

This scan is more than 90 days old.

This app has an open trust check or a verdict held for review.

Best for
General use with standard privacy expectations
What it means for you
The build may include code to pass usage data and device activity to the app developer and any integrated services. Review the category summary below for details.
Main concern
TOTP secrets stored unencrypted in SQLite, permanently exposed on rooted devices
The developer's description
Add extra security to your online accounts. 100% free, no cloud storage, developed in Europe. This app generates single-use password codes for two-factor authentication—fully offline with encrypted backups and no internet connectivity.
Third-party services
13
Findings rated low or higher
3

How the score and the label work

Open on Google PlayOpens the app's listing on Google Play in a new tab.

Full findings

Open this scan in your dashboard

The account that ran this scan sees every finding and the Rescan button there.

Trust checks

  • Secure by Design

    Items recorded, result pending review

    Security gaps detected

    Why this result

    This check looks for security issues at high severity or above in the code of this build, and at least one was recorded. Issues of this kind include a credential or token another app on the device can reach, sensitive data stored without protection, and network paths that expose information in transit.

  • Data Minimization

    Strong

    Tracking done right

    Why this result

    The check looks at analytics and attribution code for companies other than the developer: the data it reads, the companies named in code as recipients, and whether a consent step runs before that code. In this build, either no such code was recorded, or a consent step runs before it and the app's own disclosures describe the collection.

    The app contains no advertising, analytics, or tracking software of any kind. It also has no internet access, so even if tracking code were present, nothing could be transmitted. There is nothing to consent to and no tracking to opt out of.

  • Manifest Mismatch

    Strong

    Everything visible

    Why this result

    The check compares the app's privacy disclosures against what the code does: the data categories collected, the companies named in code as their recipients, and the identifiers attached to each. The comparison covers the store listing, the in-app privacy text and any privacy manifest shipped in the build. Every claim compared matched the code here.

    The app's published store listing states that no data is collected, and a full code review confirms this is accurate. The build contains no code to send data off the device, no analytics code, and no third-party service code that takes in any information. The disclosure matches what the code actually does.

  • User Control

    Strong

    No lock-in

    Why this result

    The check looks for a way to export the data an account has accumulated and a way to delete the account itself. In this build, either both were found, or the app has no account of its own and keeps its data on the device. For an app without an account, the developer has no server-side copy to export or delete, and deleting the app removes the data in its own storage.

  • Truly Local

    Strong

    Stays on the device

    Why this result

    This app presents itself as working offline or on the device alone. The check looks for any code written to send personal data to a server, including analytics, crash reporting and advertising code. None was recorded in this build.

    The app has no internet access whatsoever — not a single network call exists in the code. All two-factor secrets live only on your device. The app contains no code to send any data to a server, third party, or external service.

Strengths

  • ADB and Android Auto Backup disabled (allowBackup=false), blocking tokens.db extraction via backup
  • No INTERNET permission declared — app is structurally incapable of network transmission
  • v2 backup encryption uses AES-256-CBC with random 32-byte salt, random 16-byte IV, and 65,536 PBKDF2-SHA256 iterations
  • Device credential gate (screen lock) required before token export or QR sharing
  • ContentProvider not exported, blocking inter-app IPC access to token database
  • Strict otpauth:// URI validation with MalformedTokenException on malformed input
  • No analytics, tracking, ad, or crash-reporting SDKs active — zero data collection
  • Release build with DEBUG=false, no debug endpoints or mock data paths

What the app contains

  • 13 services

    Third-party services the scan names in the build:

    • Google Play Services (Vision)
    • ZXing
    • Google Sign-In (stub)
    • Firebase (stub)
    • Fabric/Crashlytics (manifest key only)
    • Otto (Square)
    • Picasso (Square)
    • Cupboard
    • Dexter (Karumi)
    • QRGen
    • Google Authenticator Base32
    • FontView (Pixplicity)
    • Rate (Pixplicity)

Method and limits

Static analysis: the decompiled code, manifest and resources of this build, read file by file. Network traffic at run time is established by a capture of the running app.

Files decompiled
5,129
Scan date
26 June 2026

Corrections

No correction is published for this app.

Developer response

No response is published for this app.

Report an error Opens an email to [email protected] that names this app and this scan.

On this page