AuthTrace privacy policy

Last updated: 3 November 2026

AuthTrace is a Chrome DevTools extension that captures and decodes sign-in traffic (SAML, OpenID Connect, OAuth 2.0 and WS-Federation) so IT and identity administrators can debug single sign-on. It is published by ALGD LTD ("we").

The short version

• Everything AuthTrace captures stays in your browser. We never receive it.
• AuthTrace has no servers that receive your data, no analytics, no telemetry, no advertising and no tracking.
• AuthTrace makes one kind of network request, and only when you click a button: Verify with issuer keys downloads the public discovery document and public signing keys (JWKS) of the token issuer shown in your trace. Nothing from your trace is sent with that request.

What AuthTrace reads

When DevTools is open on a tab and you have AuthTrace installed, Chrome gives the extension the network log of that tab (the same information you see in the DevTools Network panel). AuthTrace uses it to find and decode sign-in messages: SAML requests and responses, OpenID Connect and OAuth 2.0 requests, tokens and responses, and WS-Federation messages. To decode token, user-info, discovery and key responses it reads the bodies of those responses only. It does not read pages you visit when DevTools is closed, and it does not read the bodies of other requests.

This traffic can contain personal data (for example names, email addresses and user IDs inside SAML assertions or tokens) and secrets (tokens, cookies, form fields). AuthTrace processes it on your device only, to show it to you.

What AuthTrace stores

• While DevTools is open: captured requests are kept in memory. Closing DevTools or clicking Clear deletes them.
• If you save a session (Pro): the trace is stored in your browser profile (IndexedDB). You can save a redacted copy instead. Delete it any time from Saved sessions; uninstalling the extension deletes it too.
• Certificate watchlist (Pro): certificate details you choose to watch (subject, issuer, expiry, fingerprint, the IdP entity ID) are stored in your browser profile.
• Settings and licence key: stored in your browser profile (local storage).

None of this is synced to a Google account or sent to us.

Exports

When you export a trace, AuthTrace creates a file on your computer. Raw exports contain everything that was captured. Redacted exports (Pro) remove credentials and secrets and mask or hash personal data according to the options you choose. You decide where those files go.

Network requests

AuthTrace sends a network request only when you click Verify with issuer keys on a JSON Web Token. It then downloads <issuer>/.well-known/openid-configuration and the jwks_uri it names. These are public documents. The request goes from your browser to that identity provider, without cookies, and like any web request it reveals your IP address to that provider. No captured data is included.

The Pro purchase link opens Stripe Checkout in a normal browser tab. Payment is handled by Stripe under Stripe's privacy policy. After payment, our licence page reads the Checkout Session from Stripe to confirm it is paid and shows you a licence key. That page sees your Stripe checkout session ID and the email address you gave Stripe. The key contains a masked form of your email (for example j*@e*.com) and a licence ID. We keep no database of buyers beyond Stripe's own records. Entering the key in AuthTrace is checked offline and sends nothing.

Sharing and selling

We do not sell, rent or share user data. We do not use data for advertising, profiling, creditworthiness or any purpose other than showing you your own sign-in traffic. AuthTrace's use of information complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

Children

AuthTrace is a professional tool and is not directed at children.

Changes

If this policy changes, we will update the date above and describe the change in the extension's release notes.

Contact

Questions about privacy: hello@authtrace.dev