Does Pluang store my authenticator key securely?

Pluang stores the secret key behind your authenticator using encryption and hashing, technology designed to prevent unauthorized access to it. The key is what links your authenticator app to your Pluang account. It is shared once, when you scan the QR code or enter the key during setup, and from then on your app uses it to generate a new Time-Based One-Time Password (TOTP) every 30 seconds. Pluang cannot view the codes your app generates; only your registered authenticator app can produce them. The authenticator is mandatory for every Crypto Send, where its code is the third check after your PIN and an email OTP. It is not needed to receive crypto. If you lose access to your authenticator app, how you restore it depends on whether you saved the secret key at setup.

How the key is set up and used

• Setup: the Pluang app shows a QR code and a secret key. Scan the code or enter the key in any TOTP authenticator app, such as Google Authenticator or Authy.
• Storage: Pluang keeps its copy of the key encrypted and hashed.
• Codes: your authenticator app creates each code on your own device. Pluang cannot see them.
• Where it is used: every Crypto Send asks for your PIN, then an email OTP, then your authenticator code. Crypto Receive does not use the authenticator.
• After setup or reset: Cashout and Crypto Send are blocked for 24 hours as a security hold, then re-enable automatically.

Keeping the key under your control

• Write down the secret key shown at setup and keep it somewhere only you can access. It is what lets you move the authenticator to a new phone yourself.
• Do not share the key or a code from your authenticator app with anyone.

Related questions:

Q: Can Pluang see my authenticator codes?
No. Pluang cannot view the codes your authenticator app generates. Each code is created on your own device from the secret key you saved during setup, and it changes every 30 seconds. Pluang keeps its copy of the key encrypted and hashed so it can check that the code you enter is correct, but the codes themselves only ever appear in your authenticator app. That is why you need the app at hand whenever you make a Crypto Send.

Q: What happens if I lose my phone or delete the authenticator app?
If you saved the secret key during setup, you can restore the authenticator yourself: install a TOTP authenticator app on your new device and enter the key to start generating codes again. If you did not save the key, contact Pluang Care through in-app live chat, tanya@pluang.com or (021) 8063 0065 (Monday–Friday, 09:00–18:00 WIB). The team verifies your identity before resetting your authenticator.

Q: Why are Cashout and Crypto Send blocked after I set up or reset the authenticator?
Setting up or resetting the authenticator is one of the security-sensitive account changes that trigger Pluang's 24-hour hold on money leaving your account. For 24 hours from the moment the setup or reset completes, Cashout and Crypto Send are blocked, so an account takeover cannot be turned into an immediate withdrawal. Both features re-enable automatically when the 24 hours end, and there is nothing you need to do.