How Coauth protects your logins

To sync your vault and share with your team, the server stores these in readable form: • each login's site, the login page address, its username, nickname and folder • the site and account name of each passkey • the service and account name of each authenticator entry • note titles • team names, members and roles, and an activity log of team actions • your email address It never receives your vault password, your recovery key, or the secret your device uses to unlock.

Any one of three factors opens the same vault: • A vault password. Since version 1.2.5 this is how a new vault is set up. It never leaves your device: Coauth turns it into a key with Argon2id, a deliberately slow function, and refuses a password that is too weak (at least 10 characters, and hard to guess). • A device passkey, if you add one: Windows Hello or Touch ID on that computer. • A recovery key, shown once when you set up. Keep it somewhere safe. Coauth cannot reset a forgotten vault password, because it never has it.

If someone stole a copy of the Coauth database, they would get the readable details listed above, and your encrypted data, which cannot be opened without a key the server does not hold. There is one real risk. If your vault has a password, the stolen copy could be used to try guessing it offline, at the attacker's own pace, with no limit on attempts. A weak password could fall that way; a strong one is not practical to guess. That is why Coauth refuses weak vault passwords and runs every guess through Argon2id, which costs real time and 64 MB of memory. A device passkey and a recovery key cannot be guessed this way. Every night a scheduled job copies the encrypted database to separate storage outside Supabase, the service that hosts Coauth's servers. The backup holds the same encrypted data, so your secrets are no more readable there.

By default Coauth stays unlocked on your computer so autofill and passkeys keep working: the key that opens your vault is kept on the device's disk until the vault has been idle for 30 days. Someone who can read your browser profile on that computer in that time could read that key. If that matters to you, turn on "Lock when the browser closes" in Settings. The key is then kept in memory only, and you unlock again after every browser restart.

• Each team has its own key, encrypted separately for every member. Anything shared into a team can be read by every member, including the owner and admins. Members can view and copy a shared password; a shared passkey cannot be exported. • Removing a member rotates the team key and re-encrypts what is shared, so they cannot read anything shared from then on. • The limit: a new key cannot make someone forget. A removed member could have copied a password they saw, so change the password itself after removing someone. • Removing one of your own devices stops it from unlocking your vault again. A device that is unlocked at that moment keeps working until it locks.

An invite link carries a key that opens the team's shared items, so treat it like a password and do not forward it. Links expire after 48 hours. The server keeps only a one-way hash of the link's token, never the token itself, and rotating a team key cancels every invite still waiting.

Coauth signs in with a passkey only for the site the browser is really on, so a lookalike site cannot use a Coauth passkey.

• A compromised computer or browser. Malware, a keylogger or a malicious browser extension can see what you see once your vault is open. • A bad Coauth update. Like every app that encrypts on your device, Coauth has to trust its own code, and a malicious update could read secrets at the moment they are decrypted. Coauth keeps its dependencies few and its encryption code small, and every update goes through Chrome Web Store review. • What a teammate already saw. See removing someone, above. • Someone who controls your email. Your email account is how you sign in, so anyone who controls it can sign in to Coauth as you. That alone does not open your vault, but it could be used to reach what your teams share with you. Protect your email with two-factor sign-in. • The readable details. They are not encrypted, so a breach of the server would expose them. • Losing every way in. If you lose your vault password, your devices and your recovery key, nobody can open the vault, including Coauth.

Email kalpesh@buildifyapp.in with what you found and how to reproduce it. I read every report myself and reply. Please give me a chance to fix an issue before you publish it. Coauth is built and run by Kalpesh Mahida (Buildify).