Security · Twincode

The short version

Your codes live on your computer, locked with a password only you know.
We never store your codes. Not even locked.
Anything that leaves your computer is locked or sealed first, and only when you choose.

Where your codes live

Twincode keeps your accounts in your browser’s storage for extensions, on your computer. Each account is locked with AES-256-GCM encryption, using a random key. Only your password, or your recovery code, can unlock that key.

Your password is never stored. It goes through Argon2id, a recipe that’s deliberately slow and memory-hungry, so guessing it takes a very long time.
Unlocked, the key only lives in your browser’s memory for that session. Twincode locks itself after a while without use, when you close the last browser window, and when you lock Windows if you turn that on.
Nobody can reset your password, including us. Your recovery code is the only other way in, which is why Twincode asks you to save it at the start.

What leaves your computer, and when

What	When	Who can read it
The locked copy of your codes	Only if you turn on sync	Nobody without your recovery code. Your browser’s own sync carries it (for Chrome, your Google account), locked with a key that comes from your recovery code.
Sealed screenshots or backup files	Only when you use Send from phone	Only your computer. Our relay passes them on and holds them for 10 minutes at most.
A clock check	When you open Twincode (at most every 6 hours), during Send from phone, and when you ask	It asks our server for the time. Nothing about you or your codes goes with it.
A check for switched-off features	Now and then	It reads a short public list that lets us switch a feature off quickly if something goes wrong. Nothing is sent.
An install token	The first time you use Send from phone	A random token that lets your computer open Send from phone sessions. We only keep a fingerprint of it, to stop abuse.

How Send from phone keeps your screenshots private

Your computer makes a one-time key pair and shows it in a QR code. The private half never leaves that tab.
Your phone makes its own key pair. The two work out the same secret key without it ever crossing the internet (ECDH P-256 and HKDF-SHA256).
Both screens show a 4-digit match code. If they match, nobody is sitting in the middle. Your phone sends nothing until you confirm.
Your phone seals each file with AES-256-GCM before it uploads anything. The relay only ever sees sealed pieces and public keys.
Your computer picks them up, and each piece is deleted as it’s read. Whatever’s left is deleted after 10 minutes anyway.

A few more safeguards:

Only the first phone gets in. Phones can only send, and only your computer receives, so a photographed QR code gets nobody anything.
The phone page is checked. Before showing the QR code, Twincode compares the phone page with a fingerprint built into the extension. If the page has changed, Twincode refuses to use it and offers the webcam or a file instead.
You can spot a code that isn’t yours. The phone page shows the rough location of the computer that started the session, for example “Started by a computer in London, GB, 1 min ago”. That comes from our host’s network data and is deleted with the session.
We never send QR codes by email. Only scan a Send from phone code you’ve just made on your own computer.

What Twincode can do in your browser

It can’t see the sites you visit. It has no access to web pages until you click its button, press its shortcut or use its right-click menu, and then only to the page in front of you.
Secret keys never go into web pages. When Plus adds codes that fill themselves, only the 6 to 8 digit code goes in, and only on the site it belongs to.
It can only talk to gettwincode.com addresses. Your browser blocks it from contacting anywhere else.
No code is downloaded while it runs. Everything Twincode runs comes inside the extension.

What we can see, and what we can’t

We can see

That a computer asked our server for the time, or used Send from phone, and when.
The size of the sealed pieces passing through the relay, for up to 10 minutes.
The city and country of a computer that starts Send from phone, while the session lasts.
A fingerprint of each install token, when it was made, and part of the network address it came from.
Internet addresses, briefly, to apply rate limits. We don’t log them.
Emails you send us.

We can’t see

Your codes, or the secret keys behind them.
Your account names, emails or notes.
Your screenshots or backup files.
Your password or recovery code.
Which websites you visit.
Anything in your browser’s sync.

The honest limits

Anyone using your unlocked computer can see what you can see. Lock Windows when you step away. Twincode locks itself too.
Malware on your computer can see what you see. Keep Windows and your browser up to date.
Sync and backups are only as safe as your recovery code and backup password. Keep them somewhere safe, away from your computer.
Send from phone raises the bar a long way, but it isn’t magic. If a code shows up that you didn’t start, don’t continue.
Two copies means two things to look after. Your phone still has your codes, so keep it locked as well.

Found a security problem?

Email support@gettwincode.com with “Security” in the subject. Please never include real codes, screenshots, backup files or passwords. Fake test accounts are perfect.

For what we do with personal information, read the privacy policy.