Security
How your sign‑in is protected
IDUnify keeps very little about you, and the part that matters most — your password — is handled by Google and Firebase, never by the websites you visit.
Protections
| Area | What we do |
|---|---|
| Accounts | Stored and checked by Google Firebase Authentication. |
| Passwords | Email passwords are stored as a one-way scrypt hash. Nobody can read them, including us. Google sign-in passwords never reach IDUnify at all. |
| Separate sign-in window | You type your password on auth.idunify.com or Google, never on the website you came from. |
| Encryption | Every IDUnify page uses HTTPS (TLS), with certificates from Google Trust Services and Let's Encrypt. |
| Short-lived tokens | The proof of sign-in a website receives expires after one hour and renews on its own. |
| Allowed websites only | Sign-in works only on websites we have added to IDUnify's allowed list. |
| Verified by Google | Google reviewed and verified the IDUnify app name, logo and policies in October 2026. |
| Minimal data | A website receives your account ID, email, name and (with Google) photo. Nothing else. |
How to spot a real IDUnify sign-in
- The address bar shows
auth.idunify.comoraccounts.google.com, with a padlock. - Google's screen names the app IDUnify.
- You opened it yourself, from a website's “Continue with IDUnify” button.
- Password reset emails come from IDUnify and their links open on
auth.idunify.com.
IDUnify never asks for your password by email, chat or phone. If someone does, it is not us. Do not reply — forward it to support@idunify.com.
Report a problem
Found a security issue, or a page pretending to be IDUnify? Email support@idunify.com with “Security” in the subject. Include the address of the page and what you saw. Please give us time to fix an issue before you share it publicly. We do not take legal action against people who report in good faith.
Machine-readable contact: /.well-known/security.txt