Security
Your authentication secrets deserve stronger protection.
NexKey is designed so that normal OTP generation happens directly on your device. This page describes what that means in practice, and where the trust boundaries sit.
Security overview
Two properties shape the design: codes are generated locally, and anything that leaves your device is encrypted before it does.
-
Local OTP generation
Codes are computed on-device from the stored secret and the current time or counter.
-
Platform-secure secret storage
iOS and macOS Keychain, Android Keystore. Secrets are never written to plain files.
-
Touch ID / Face ID protection
Biometric unlock gates access to the vault; the OS enforces it.
-
End-to-end encrypted sync
Encryption happens before upload with a device-held key.
-
Trusted device approval
New devices join only after approval from an existing trusted device.
-
No plaintext OTP secrets in the backend
The server stores ciphertext and metadata it cannot decrypt.
Storage and biometrics
Keychain and Android Keystore
Authenticator secrets are held in platform secure storage rather than in plain application files, so they are protected by the operating system's own key management.
Biometric protection
Access to the authenticator can be gated behind the platform biometric check, so codes are revealed only after it succeeds.
Encrypted synchronization
Sync is optional. When it is on, your vault is encrypted on your device before upload and decrypted only on devices you have trusted.
-
iPhone Secrets live in the Secure Enclave–backed Keychain.
-
Encrypt locally Vault is encrypted with a key that never leaves the device.
-
Encrypted Vault Backend stores ciphertext. It has no key to read it.
-
Trusted Mac Only devices you approved hold a decryption key.
-
Decrypt locally Plaintext exists only in memory on the trusted device.
Trust boundaries
Where data is readable, and where it is not.
Trusted device model
Every device is enrolled explicitly. You can review the list and revoke any device, which stops it receiving further synchronized data.
Backend trust boundary
The NexKey backend transfers and stores ciphertext. It does not hold readable OTP secrets and does not generate codes on your behalf.
Secure clipboard handling
Copied codes are short-lived: NexKey clears the clipboard entry after a short interval so a code does not linger there.
No plaintext logging
OTP secrets and generated codes are treated as sensitive and excluded from application logs and diagnostics.
Works offline
Because generation is local, an unavailable backend does not stop you signing in anywhere.
This website
nexkey.app is a marketing site. It contains no OTP implementation, accepts no authenticator secrets, and stores nothing in your browser.
Open standards
NexKey implements published specifications so its behaviour can be checked against them.
Responsible disclosure
Reporting a security issue
If you believe you have found a vulnerability, email us with the details and any steps to reproduce. Please give us a reasonable window to investigate and ship a fix before disclosing publicly.
We will acknowledge your report, keep you updated while we investigate, and credit you when a fix ships, if you would like us to.
One key. Every device.
Secure your accounts with NexKey on mobile and Mac.
- iPhone · Coming soon
- Android · Coming soon
- macOS · Coming soon