About
2FA by DependsiT is built by DependsiT, an independent software team that ships security tools with the source of every claim open to inspection.
Most services say your data is encrypted and mean they hold the key. Here the key never leaves your device. Your master password derives the encryption key in your browser, the server receives ciphertext, and no engineer, subpoena, or breach can decrypt what was never decryptable on the server.
Forgetting a master password normally triggers a reset flow, and every reset flow is a hole in the encryption. We chose the honest option: if you forget the master password, the vault is gone. Write it down somewhere safe, keep an encrypted export, and the risk is yours to manage instead of everyone's.
The homepage tool works with no account, stores nothing, and makes zero data-bearing requests. You can verify that claim in your browser's network inspector in about ten seconds. Privacy claims you cannot verify are marketing; this one is structural.
The free tier is not a trial and has no clock. 100 folders and 100 entries covers personal two-factor needs indefinitely, and free accounts get every code type and every input method.
The cryptography follows published standards: PBKDF2 with a salted derivation, HKDF key separation, AES-256-GCM item encryption, and Argon2id for server-side authentication hashes. The one-time password engine implements RFC 4226 and RFC 6238. The guest tool and the vault share the same platform-agnostic core, which is why both behave identically online and off.
Beyond the code, every release passes a layered security pipeline: secret scanning across full history, dependency audits, static analysis, and a security review of every diff before it merges.