# Yubico Authenticator privacy rating

Authenticator app from Yubico that stores OATH one-time password secrets on a YubiKey instead of the phone or computer, and generates codes when the key is connected or tapped.

## Summary

Yubico Authenticator scores 50 out of 100 (grade D) on the two-factor authentication criteria. It meets 2 of 4 criteria: open source and no ads or data sales. It does not meet no trackers or telemetry and independent audit. It is based in Sweden: Fourteen Eyes member; EU member (GDPR).

- Website: https://www.yubico.com/products/yubico-authenticator/
- Source code: https://github.com/Yubico/yubioath-flutter
- License: Apache-2.0
- Jurisdiction: Sweden. Fourteen Eyes member. EU member (GDPR).
- Platforms: Windows, macOS, Linux, Android, iOS
- Home page trackers: Google Tag Manager
- Category: [Two-factor authentication](https://privacyratings.com/two-factor-authentication/)
- Grade: D (50/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Yes | Apache-2.0. The iOS app is in a separate repository under the same license. | https://github.com/Yubico/yubioath-flutter/blob/main/LICENSE |
| No trackers or telemetry | No | The Android app collects no data and Exodus finds no trackers, but the Yubico website loads Google Tag Manager. | https://www.yubico.com/products/yubico-authenticator/ |
| No ads or data sales | Yes | Free app funded by YubiKey hardware sales, with no ads. The Play data safety listing declares no data collected or shared. | https://play.google.com/store/apps/datasafety?id=com.yubico.yubioath |
| Independent audit | No | No independent audit is published. |  |

Source: https://privacyratings.com/two-factor-authentication/yubico-authenticator/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/two-factor-authentication/yubico-authenticator.md