Drop Authenticator Security & Privacy Scorecard

Drop Authenticator

What This Means for You

Your two-factor authentication codes stay entirely on your device, never reaching any server or third party, so your account security stays fully in your hands.

Recommendation: Very Secure

This authenticator protects your backup files with strong encryption, operates with zero tracking, and has no ability to connect to the internet. It is ideal for security-conscious users who want an encrypted, tracker-free two-factor authentication app.

Best For: Users who want a simple, fully offline, tracker-free two-factor authentication app

Key Findings

Data Security - 2 findings (1 medium, 1 low)

Network Security - 0 findings

Code Safety - 1 finding (1 medium)

Privacy - 0 findings

Privacy Concerns

What Data is Collected

• Authentication secrets: Accessed and stored on your device only. No authentication data leaves your device.
• Camera: Accessed on your device to scan QR codes during account setup.
• Local storage: Accessed on your device for creating and restoring encrypted backup files.

Third-Party Data Sharing

No third-party data sharing was identified in this analysis.

Understanding the Scores

Security: 88/100
Privacy: 100/100

Security Breakdown

• Data Security: 85/100 - Your authentication secrets are stored locally on your device in a database. The current setup guards well against remote access, though adding Android's hardware-backed storage protection would further strengthen resistance to physical device access.
• Network Security: 100/100 - The app has no internet capability. All data stays on your device with no possibility of network transmission.
• Code Safety: 90/100 - The app is built cleanly in production mode with debug settings fully disabled and strict input validation on all account imports.

Privacy Breakdown

• Data Collection: 100/100 - The app does not collect any data and has no capability to transmit anything off your device.
• Data Sharing: 100/100 - No data is shared with any third party.
• User Control: 100/100 - Your authentication data lives only on your device, fully under your control.

Positive Security Features

• The app has no internet permission, making it structurally incapable of sending your data anywhere
• Backup files are protected with strong encryption using a unique key and random initialization vector generated each time
• Your device screen lock is required before you can export or share your two-factor codes
• No analytics, advertising, or crash-reporting services are active in this app
• Your authentication codes cannot be extracted through Android's backup system (Android backup is disabled)
• Other apps installed on your device cannot access your authentication database
• Released in production mode with debug settings fully disabled
• Strict validation of authentication input prevents malformed codes from being imported

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Data Deletion Transparency
   The Play Store data safety section notes that stored data cannot be deleted. Clarifying in the app or privacy policy how users can remove their locally stored authentication data would improve transparency for users in regions with formal data deletion rights.

Security Enhancements

1. On-Device Storage Protection
   The database containing your authentication secrets could use Android's hardware-backed secure storage for an additional layer of protection, making the data more resistant to extraction if your device is physically compromised.

2. Screen Content Protection
   Enabling screen content protection would prevent live authentication codes from appearing in the device task switcher thumbnail or being visible to screen-recording apps.

Technical Context

App Type: Two-factor authentication tool, sensitive data
Classes Analyzed: 5,129
Third-Party Services: 13 identified (on-device libraries; none transmit data)
Context Tags: sensitive_data, camera, authentication

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: DROP TABLE Companies B.V.
Version: 1.2.11 (versionCode 102011)
Analysis Date: 2026-06-26
Package: com.pixplicity.auth

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 1.2.11 analyzed on 2026-06-26
• May not reflect server-side security controls
• Cannot detect all runtime behaviors