Coding Friend LLC

← All Never Lose Codes guides

Security: how Never Lose Codes protects your codes

A plain description of what Never Lose Codes does with your two-factor secrets, for anyone who wants the details before trusting an extension with them.

What the extension can't do

  • No website access. The extension asks Chrome for no host permissions and runs no scripts on web pages. It can't read or change the sites you visit, so Chrome shows no "read and change your data" warning on install.
  • No network calls. The extension doesn't send your codes, account names or backups anywhere. Codes are made on your computer.
  • No remote code. All code ships inside the extension package Chrome Web Store reviews. Its content security policy only allows the extension's own scripts.
  • No account. There's nothing to sign in to and no server copy of your data.

Its permissions are: storage and unlimitedStorage (keep your encrypted vault), alarms (daily backup and the weekly integrity test), and downloads and downloads.ui (write encrypted backup files to your Downloads folder without a pop-up each time).

How your codes are encrypted

  • A random vault key (AES-256-GCM) encrypts every account record. Each record gets a fresh 96-bit random IV, and its record ID is bound in as additional authenticated data, so records can't be swapped or altered without detection.
  • The vault key is never stored readable. It's kept only in wrapped (encrypted) form:
    • by a device key held in Chrome as a non-extractable key, so the app opens without typing anything on your computer;
    • by your recovery key, so backups and recovery work anywhere;
    • optionally by your app password. When you set one, the device wrap is removed, so nothing opens without the password or the recovery key.
  • Password and recovery-key wrapping uses PBKDF2-SHA256 with 600,000 iterations and a random salt, the setting the OWASP Password Storage Cheat Sheet recommends for PBKDF2-HMAC-SHA256. When unwrapping, files claiming fewer than 600,000 or more than 5,000,000 iterations are refused.
  • The recovery key is 26 characters from a 31-symbol alphabet, generated with rejection sampling so every character is equally likely: about 128.8 bits of randomness.

All of this uses the Web Crypto API built into Chrome. The extension doesn't ship its own encryption code.

Codes

Time-based codes follow RFC 6238 (TOTP), and counter-based codes follow RFC 4226 (HOTP), with SHA-1, SHA-256 and SHA-512, 6 or 8 digits. The implementation is tested against the official test vectors from both RFCs.

Backups

  • Backup files hold your encrypted records plus the recovery-key wrap only. They don't contain the device key or your password wrap, so a backup opens with the recovery key and nothing else.
  • Each file carries a checksum. A damaged or altered file is rejected before anything changes.
  • Restore only adds. It never overwrites, rolls back, or moves to Trash an account you already have, because a backup file's timestamps and Trash marks can't be trusted the way your own vault's can. Accounts you already have are skipped; if a restored account has the same internal ID as a different one of yours, it's added as a separate copy.
  • Every backup file is decrypted in full before anything is written. If any record fails, nothing is restored.

Checks while it runs

  • A weekly integrity test confirms every account still decrypts.
  • After each backup file is written, the extension confirms with Chrome that the whole file was saved. Older files are only cleaned up after a newer one is confirmed.
  • Deleted accounts go to Trash for 30 days before they're removed.

How it was checked

The code runs against 53 automated tests and 45 checks in a real Chrome browser, including importing a real Google Authenticator export, checking codes with an independent TOTP implementation, confirming backups contain no readable data, and recovering after Chrome's key was wiped.

Two separate AI security reviews examined the encryption, key handling, auto-lock, backup and import code, one before launch and one for version 1.0.1. Neither found a critical issue. Every issue they did find was fixed and is covered by an automated test. These reviews were done by AI models, not a human security firm. We'd rather tell you that plainly than let "audited" imply more than it means.

So you don't have to take our word for it, the full source code is public, with every finding and fix from both reviews listed: Never Lose Codes on GitHub (see SECURITY.md).

What it doesn't protect against

  • Someone using your unlocked computer. Without an app password, anyone at your computer can open your codes, just like your email. Set an app password if others use your computer. It locks after Chrome restarts and after 15 minutes.
  • Malware on your computer can read what's on your screen and what you type. No browser extension can protect against that.
  • Losing both your recovery key and every working copy. Then the backups can't be opened by anyone.

Source code

The source code isn't published yet. When it is, we'll link it here. Until then, if you're a security researcher and want to look, email support@codingfriendllc.com, and please report anything you find there too.

Never Lose Codes is a Chrome extension that keeps your 2FA codes encrypted on your computer, with backup files you hold and a recovery key. See how it works.