Is Authenticator: Generate 2FA Codes in Browser safe?

Authenticator stores TOTP enrollment secrets using a hardcoded fallback key when access-key encryption is off.

Authenticator saves enrolled otpauth:// URIs in local browser storage as encryptedURIs. When access-key encryption is disabled or unset, the bundled code uses a hardcoded fallback key, so those locally stored TOTP secrets can be decrypted offline from the extension data.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.