You turned on two-factor authentication, and now your phone asks for a six-digit code every time you log in. Good. The next question is which app should make those codes. Two-factor authentication is a second check at login, like a code from an app, so a stolen password alone is not enough.
Picking the best authenticator app is less about the codes and more about two other things. Who can see your accounts, and what happens when you lose or replace your phone? Some apps keep your codes private. Some make it easy to move to a new phone. A few do both. Some do neither.
This comparison is based on research into each app’s own pages and news coverage, not on hands-on testing. The short answer: choose Ente Auth if you want one app on your phone and computer, choose Aegis if you use Android and want full control of your backups, and avoid any app that traps your codes inside it.
The quick comparison
Ente Auth and Aegis are the two apps with the most detail in the research, so the table sets them side by side. 2FAS and the big-name apps follow in their own sections.
| What you care about | Ente Auth | Aegis Authenticator |
|---|---|---|
| Open source (anyone can read the code) | Yes, fully [1] | Yes, and free [2] |
| Where it runs | Phone, computer and web [1] | Android [2] |
| Backups | Encrypted backups [1] | Automatic backups to a place you pick [2] |
| Moving your codes in or out | Export and import, no lock-in [1] | Can import from Authy, Google Authenticator and others [2] |
Why does open source matter for an authenticator app?
Open source means anyone can read, check and improve the code. For an app that holds the keys to your accounts, that is a real benefit. You do not have to trust a promise. Other people can look.
Ente Auth is open source, and Ente says outside parties have audited its cryptography [1]. Aegis is a free, open source app made for Android [2]. The Android app from the 2FAS project is also open source, and its code is released under the GNU General Public License v3.0 [3].
Open source does not make an app perfect. It does mean the app has nowhere to hide. If privacy is your main goal, start your search here.
Which app is best if you use more than one device?
Ente Auth wins this one. It has apps for mobile, desktop and web, so your codes sync across devices [1]. If you log in from a laptop all day, that saves you from reaching for your phone every time.
Aegis is made for Android [2]. That is a limit if you also want codes on a computer. It is a bigger limit if you have an iPhone. If that is you, Aegis is out, and Ente Auth is the one on this list that clearly covers mobile and desktop [1]. Check the app store for your own phone before you commit.
The 2FAS project calls its Android app the official one [3]. The research does not cover its other versions, so check what 2FAS offers for your devices before you pick it.
Where does the loser win? Aegis does not need to sync your codes through anyone’s servers. Some readers like that. A tool that stays on one phone has fewer ways to leak.
Which app is better for backups and avoiding lockout?
This is the question that matters most. A lost phone with no backup can mean losing access to your accounts. Many people only find that out on the worst day.
Ente Auth offers end-to-end encrypted backups [1]. That means only you can read the backup, not the company that stores it. You can also use Ente Auth without an account and without backups, in an offline mode [1]. That is a useful choice if you would rather keep everything on your own device. The trade-off is that you then own the whole job of not losing it.
Aegis can make automatic backups of its vault to a location you choose [2]. You decide where the copy lives. That is a strong setup if you like control. It also means the job of keeping that copy safe is yours.
So it is close to a tie. Ente Auth is easier if you want the app to handle backups. Aegis is better if you want to pick the place yourself. The research on 2FAS does not cover its backups, so look at that before you rely on it.
Here is a rule that works for any app. Set up your backup on day one, not after you have a problem.
Can you move your codes to another app later?
You should be able to. An app that holds your codes hostage is a bad deal, even if it is free.
Ente says you can export and import your data, with no lock-in [1]. Aegis can import tokens from several other apps, including Authy and Google Authenticator [2]. Those tokens are the secrets behind your codes. Moving them means you do not have to redo every account by hand.
This matters because of what happened to Authy users. Twilio shut down the Authy desktop app and logged all users out of it [5]. Some people who had synced their desktop app to their phone found that some of their tokens did not sync, which left those accounts out of reach [5]. If you ever need to leave an app, you want an easy way out before it closes, not after.
What should you know about Google Authenticator and Authy?
Both are popular, and both have a history worth knowing.
Google Authenticator added account sync in 2023. Security researchers found that the traffic used to sync the codes was not end-to-end encrypted [4]. Google said it planned to add end-to-end encryption later [4]. That was the plan at the time. The research here does not say whether it has shipped, so check the current settings before you trust the sync.
Authy has had two public problems. One is the desktop shutdown described above [5]. The other is a leak of phone numbers. Attackers used an unsecured Authy API (a way for programs to ask Authy for data) to build profiles of 33 million phone numbers on Authy [5]. Your phone number is not your code, but it is the kind of detail that helps someone target you.
Neither of these means you must leave today. They do mean you should know what you are trusting. If you use either one, check that you have a backup and that you can export your codes.
Which should you pick?
Here are three people and the pick for each.
Jake, who uses an Android phone and likes control
Jake wants to decide where his backups live. He should use Aegis [2]. It is free and open source, and it makes automatic backups to a location he picks [2]. He should store a copy somewhere other than his phone.
Sarah, who works on a laptop and a phone
Sarah logs in on both all day. She should use Ente Auth, since it has mobile, desktop and web apps that sync [1]. She gets encrypted backups too [1].
Emily, who is using Authy or Google Authenticator today
Emily’s codes work fine, so she does not need to panic. She should pick a new app, such as Aegis or Ente Auth, and move her codes over one account at a time. Aegis can import from both of her current apps [2]. Ente says you can export and import your data [1]. Keep the old app until every account works in the new one.
You can skip the rest of the market. Any app that is open source, lets you take your codes out and has a backup you control is good enough. Once it is set up, go back to your life.
Common mistakes
- Switching on two-factor authentication and never making a backup. A lost phone then becomes a locked account.
- Keeping the only copy of your codes on one phone. Keep a second copy somewhere safe.
- Deleting the old app before the new one works for every account. Test each login first.
- Trusting sync because it is on by default. Google Authenticator’s sync at launch was not end-to-end encrypted [4].
- Relying on a desktop app that a company can shut down. Authy’s desktop app was closed and users were logged out [5].
- Choosing an app because it is popular, not because you can leave it. An app you cannot leave is a risk.
Pick one this week
Choose one app from this list, move your most important accounts first (email, then banking), and make a backup the same day. Do that, and the next time you lose a phone, you will lose a phone and nothing else.
For the technically curious
The six-digit codes come from a standard called TOTP, which mixes a secret key with the current time. The standard recommends a default time step of 30 seconds, which is why a code changes twice a minute [6]. The 2FAS app supports both time-based codes and counter-based ones, called HOTP [3].
Aegis encrypts its vault with AES-256-GCM, a widely used encryption method. You can unlock the vault with a password or with biometrics through the Android Keystore [2].