Can I trust Ente Auth - 2FA Authenticator?
This scan is more than 90 days old.
This app cleared every trust check that applied to it, with no red flags.
- Best for
- Security-minded users protecting 2FA codes
- What it means for you
- Ente Auth stores two-factor authentication secrets locally with strong encryption, excluded from iCloud backups by default. The app includes code to send crash reports to Sentry, with code that strips authentication tokens and cookies from them first. The build includes no code to send user data to advertising, analytics, or attribution services.
- Main concern
- Sentry Session Replay SDK linked; screen capture activation unconfirmed in AOT binary
- The developer's description
- Ente Auth is an open-source 2FA authenticator with end-to-end encrypted backup, biometric app lock, and strong cryptography for secure authentication.
- Third-party services
- 5
- Findings rated low or higher
- 0
Open on the App StoreOpens the app's listing on the App Store in a new tab.
Full findings
Open this scan in your dashboardThe account that ran this scan sees every finding and the Rescan button there.
Trust checks
Secure by Design
StrongStrong security foundation
Why this result
This check looks for security issues at high severity or above in the code of this build, and none were recorded. Its scope covers stored credentials, how the app protects data on the device, and how it protects data in transit.
The app uses modern, industry-leading encryption for all cryptographic operations, forces all network traffic over secure connections with no exceptions, stores secrets in the device's secure keychain, protects screenshots in the iOS app switcher, and includes biometric app lock. No critical or high security vulnerabilities were found. The only findings were informational notes about capabilities that could not be confirmed as active.
Data Minimization
StrongTracking done right
Why this result
The check looks at analytics and attribution code for companies other than the developer: the data it reads, the companies named in code as recipients, and whether a consent step runs before that code. In this build, either no such code was recorded, or a consent step runs before it and the app's own disclosures describe the collection.
Manifest Mismatch
StrongEverything visible
Why this result
The check compares the app's privacy disclosures against what the code does: the data categories collected, the companies named in code as their recipients, and the identifiers attached to each. The comparison covers the store listing, the in-app privacy text and any privacy manifest shipped in the build. Every claim compared matched the code here.
The app's actual behavior matches what an honest privacy disclosure for a two-factor authenticator would say. Crash reporting via Sentry is a standard, widely disclosed practice. No hidden data collection, undisclosed third-party sharing, or behavior that would surprise a user reading the app's privacy policy was found.
User Control
StrongNo lock-in
Why this result
The check looks for a way to export the data an account has accumulated and a way to delete the account itself. In this build, either both were found, or the app has no account of its own and keeps its data on the device. For an app without an account, the developer has no server-side copy to export or delete, and deleting the app removes the data in its own storage.
Truly Local
StrongStays on the device
Why this result
This app presents itself as working offline or on the device alone. The check looks for any code written to send personal data to a server, including analytics, crash reporting and advertising code. None was recorded in this build.
Your two-factor authentication secrets are stored in the device's secure keychain, not sent to third-party servers. When syncing to Ente's cloud, the app uses end-to-end encryption with keys that never leave your device. App data is excluded from unencrypted device backups. No advertising networks, data brokers, or third-party services are named in code as destinations of your personal data.
Strengths
- Keychain-backed secret storage via flutter_secure_storage (SecItem API confirmed)
- Screenshot protection in iOS app switcher via privacy_screen.framework
- Biometric app lock with Face ID / Touch ID via local_auth_darwin.framework
- iCloud backup exclusion via backup_exclusion.framework (NSURLIsExcludedFromBackupKey=true)
- No tracking, advertising, or attribution SDKs present
- HTTPS enforced system-wide via ATS default (no NSAppTransportSecurity exceptions)
- Sentry HTTP header sanitization strips auth tokens, cookies, and CSRF tokens from crash reports
- No WebView or JavaScript bridge attack surface
- Strong modern cryptography via libsodium 1.0.20 (ChaCha20-Poly1305, XChaCha20-Poly1305, AEGIS-256, Curve25519)
- Minimal permission surface — camera, FaceID, photo library only
What the app contains
5 services
Third-party services the scan names in the build:
- Sentry
- Flutter
- libsodium
- SDWebImage
- MTBBarcodeScanner
Libraries
| Library | Version | Advisory |
|---|---|---|
| SDWebImage | 5.21.5 | none confirmed |
| Sentry | 8.46.0 | none confirmed |
| App | 1.0 | none confirmed |
| DKImagePickerController | 4.3.9 | none confirmed |
| DKPhotoGallery | 0.0.19 | none confirmed |
| Flutter | 1.0 | none confirmed |
| MTBBarcodeScanner | 5.0.11 | none confirmed |
| Runner | not recorded | none confirmed |
| SwiftyGif | 5.4.5 | none confirmed |
| app_links | 6.4.1 | none confirmed |
Show all 41 librariesShow fewer
Method and limits
Static analysis: the decompiled code, manifest and resources of this build, read file by file. Network traffic at run time is established by a capture of the running app.
- Files decompiled
- 33
- Scan date
- 17 June 2026
Corrections
No correction is published for this app.
Developer response
No response is published for this app.
Report an error Opens an email to [email protected] that names this app and this scan.