Ente Auth - 2FA Authenticator Security & Privacy Scorecard

by Ente Technologies, Inc. · iOS

94
Overall trust score
Very Secure
96
Security
93
Privacy

Ente Auth stores two-factor authentication secrets locally with strong encryption, excluded from iCloud backups by default. Crash reports are sent to Sentry with authentication tokens and cookies stripped before transmission. No advertising, analytics, or attribution services receive user data.

Best for

Security-minded users protecting 2FA codes

Findings

  • 0 critical
  • 0 high
  • 0 medium
  • 0 low
  • 3 info

1 issue identified across security and privacy analysis.

Top security issues

  • SQLite Database Without Application-Layer Encryption
  • Custom URL Schemes otpauth:// and enteauth:// — Handler Validation Unconfirmed
  • Sentry Session Replay SDK Linked — Activation Unconfirmed in Dart AOT Binary

Top privacy issues

  • Sentry Session Replay SDK Linked — Activation Unconfirmed in Dart AOT Binary
  • SQLite Database Without Application-Layer Encryption
  • Custom URL Schemes otpauth:// and enteauth:// — Handler Validation Unconfirmed

Full analysis

Ente Auth

What This Means for You

Your authentication codes are protected by end-to-end encryption, secured in the iOS Keychain with biometric lock, and shielded from screenshots and device backups.

Recommendation: Very Secure

Ente Auth offers excellent security with strong encryption, biometric app lock, and robust privacy. Highly recommended for users prioritizing 2FA security.

Best For: Users who want a secure, open-source 2FA authenticator with end-to-end encrypted cloud backup

Key Findings

Data Security - 1 finding (1 info)

Network Security - 0 findings

Code Safety - 1 finding (1 info)

Privacy - 1 finding (1 info)

Privacy Concerns

What Data is Collected

  • Authentication codes and account names: accessed on your device and stored securely in the iOS Keychain
  • Camera access: used on your device for QR code scanning
  • Crash diagnostics: may be sent to Sentry's servers when the app encounters an error

Third-Party Data Sharing

The following third parties may receive your data:

  • Sentry - crash reporting and error diagnostics (sensitive headers removed before transmission)

Understanding the Scores

Security: 96/100
Privacy: 93/100

Security Breakdown

  • Data Security: 95/100 - Authentication secrets are stored in the iOS Keychain with hardware-backed protection, and the app excludes all data from iCloud backups.
  • Network Security: 100/100 - All connections use enforced HTTPS with no exceptions, and crash reports automatically strip sensitive session data before leaving your device.
  • Code Safety: 97/100 - Strong open-source cryptography powers the app's core functions, and the permission surface is kept to the minimum required.

Privacy Breakdown

  • Data Collection: 100/100 - Only crash diagnostics may be sent to Sentry when errors occur. No advertising, tracking, or behavioral profiling data leaves your device.
  • Data Sharing: 100/100 - No advertising or tracking networks receive any data. Crash reports sent to Sentry have sensitive session data removed before transmission.
  • User Control: 100/100 - Biometric app lock, screenshot protection, and backup exclusion give you strong control over your authentication data.

Positive Security Features

  • Authentication secrets are stored in the iOS Keychain, protected by hardware-level security
  • Biometric lock (Face ID / Touch ID) prevents unauthorized app access
  • The app prevents screenshots in the iOS app switcher, protecting codes from accidental exposure
  • iCloud backup exclusion keeps authentication codes from being stored in device backups
  • No advertising, tracking, or behavioral analytics SDKs are present
  • All network communication uses enforced HTTPS with no exceptions
  • Crash reports have sensitive headers, cookies, and session data removed before transmission to Sentry
  • Strong open-source cryptography powers end-to-end encrypted cloud backups
  • Minimal permissions: camera, Face ID, and photo library access only

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

  1. App Privacy Manifest
    Adding an app privacy manifest could make the App Store privacy label more complete and help users understand exactly which data types the app accesses.

  2. Crash Reporting Transparency
    Documenting in the privacy policy exactly what data Sentry may receive during crash events would give users clearer visibility into third-party data flows.

Security Enhancements

  1. Additional Database Encryption
    Adding application-layer encryption for the local database would provide an extra layer of protection for any metadata stored locally, complementing the existing iOS system-level protections.

  2. URL Scheme Import Confirmation
    Ensuring a visible confirmation dialog always appears when importing 2FA codes via URL schemes guards against crafted links that could introduce unintended secrets into the vault.

Technical Context

App Type: Two-factor authentication manager (high sensitivity)
Classes Analyzed: 33
Third-Party Services: 5 identified (Sentry, Flutter, libsodium, SDWebImage, MTBBarcodeScanner)
Context Tags: sensitive_data, camera

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Ente
Version: 4.4.23 (Build 1023)
Analysis Date: 2026-06-17
Package: io.ente.auth

Analysis Limitations

  • Static analysis only (code review without running the app)
  • Based on IPA version 4.4.23 analyzed on 2026-06-17
  • May not reflect server-side security controls
  • Cannot detect all runtime behaviors
  • Dart AOT compilation limits visibility into certain app behaviors

Versions & scan history

ScanDateOverall score
#6 (current) 94/100