Authenticator 🔑
SigNote Authenticator stores TOTP credentials and generates verification codes locally. Seeds, service names, account names, and generated codes are never sent to the server in plaintext.
Setting up a device
Authenticator uses the same encryption passphrase as Secrets and Seals, but derives a separate otpVaultKey. Entering the passphrase from the Auth page leaves Secrets softly locked: SigNote remembers the passphrase-derived share for this tab, but does not leave Secret bodies visible.
You can choose between two local modes:
- Trust this device stores the non-extractable Authenticator key in this browser. Codes survive reloads and work offline after the Auth page has been loaded successfully.
- This visit only keeps the key in memory. Closing or reloading the page removes access and requires the passphrase again.
Trust only a personal browser profile protected by your device login. On a shared or borrowed computer, use the visit-only option.
Adding credentials
You can scan a TOTP QR code with the camera, decode a QR image or pasted screenshot, paste an otpauth:// link, or enter a Base32 setup key manually. QR images are decoded in the browser and are never uploaded.
SigNote supports SHA-1, SHA-256, and SHA-512 TOTP credentials with 6, 7, or 8 digits and configurable periods. HOTP counters and bulk migration QR codes are not supported yet.
Generated codes are never persisted. They are calculated from the encrypted seed and the corrected local time whenever the current period changes.
Sync and offline access
The server stores only AES-GCM ciphertext plus synchronization metadata. Each ciphertext is bound to its record ID, preventing one encrypted payload from being substituted for another.
On a trusted device, cached credentials continue generating codes when the network is unavailable. Changes are read-only until you reconnect. The Auth page synchronizes when it opens, when connectivity returns, when the window regains focus, and periodically while it remains open.
Signing out, session expiry, or remote session revocation clears the trusted Authenticator key and encrypted cache from that browser. The Auth page then shows the normal sign-in state. This does not weaken offline use: while the network is unavailable, SigNote uses the cached authenticated session and keeps codes available locally.
Visit the Auth page once while online before relying on it offline. Browser storage may be evicted, particularly in private windows and on iOS when SigNote is not installed to the Home Screen. Your encryption passphrase can enroll the device again.
Exporting and removing access
An exported otpauth:// link contains the permanent setup seed. SigNote requires the encryption passphrase again before revealing it. Anyone who obtains that link can generate future codes.
To remove offline Authenticator access from the current browser, open Profile, find Authenticator, and choose Forget this device. This deletes the persisted key and encrypted local cache; it does not delete credentials from your account or other devices.
Resetting the complete encryption profile deletes Authenticator data and changes the profile generation. Other trusted devices erase their obsolete local key the next time they synchronize. A device that remains permanently offline cannot be erased remotely.
→ See Encryption for the key hierarchy and Threat model for the trusted-browser boundary.