2FAS Authenticator review: open source, no account

2FAS Auth is a free, open-source authenticator for iPhone and Android that works without an account and keeps your codes on your own device. It generates the standard time-based codes (TOTP, see our explanation of TOTP codes) that thousands of services accept as a second factor, and it adds a few useful extras: encrypted backup, a browser extension and Apple Watch support. This review is an editorial assessment based on the vendor’s documentation and published information as of October 2026, not a laboratory test.

Who is behind it

2FAS is developed by a Poland-based team, registered as Two Factor Authentication Service, Inc. The authenticator is free. A separate password manager, 2FAS Pass, exists with paid options, but this review covers only the authenticator. The project publishes its source code on GitHub, including the mobile apps, the browser extension and the API, and it documents its cryptography.

Key features

Feature	2FAS Auth
Platforms	iOS, Android, browser extension, Apple Watch
Account required	No
Works offline	Yes
Backup	Optional encrypted backup to your own cloud account; manual export including password-protected files
Open source	Yes (apps, extension, API)
Organisation	Groups, icons, badges and labels; search
Lock	PIN protection; tokens can be hidden until needed
Origin	Poland
Cost	Free

Backup and export

The most important question for any authenticator is what happens when you lose the phone. 2FAS offers an encrypted synchronisation to your own cloud account and a manual export in its backup format, optionally protected by a password. Your tokens are encrypted before they leave the device, and the team states that it does not collect or see user data. That puts you in control, but it also puts responsibility on you: if you forget the backup password, nobody can recover it for you.

Do three things when you set it up. Turn on the encrypted backup before adding many accounts, write the backup password into your password manager or another safe place, and test a restore on a second device. Our guide to backup codes covers the other half of recovery: the one-time codes each service gives you when you enable 2FA.

Browser extension and Apple Watch

The optional browser extension is a distinguishing feature. After you pair it with the phone app, a login request appears on your phone, you confirm it, and the code travels to the browser over an end-to-end encrypted connection. It saves typing six digits on the computer. It does not create a separate desktop store of codes, which keeps the phone as the single source.

The app also supports the Apple Watch, so you can read codes on your wrist. Tokens can be sorted into groups and labelled, which matters once you have thirty or more accounts.

Privacy and openness

2FAS says that secrets stay on the device unless you decide otherwise, that no account is needed and that it works offline. Because the code is open, researchers can check how secrets are stored and how backups are encrypted. As with any app, openness is a good sign, not a certificate. We have not performed a code audit, and you should treat claims about security as the vendor’s statements.

Limits

• No desktop app. The browser extension helps, but there is no native Windows, macOS or Linux app. If you want codes on a computer without the phone, look at Ente Auth.
• Backup is not live sync. You restore from a backup instead of having a continuously synchronised vault across several devices.
• Mobile only for secrets. If your phone is your single copy and you skip the backup, you can be locked out.
• Codes are still phishable. A convincing fake site can ask for the six digits. Passkeys and hardware keys resist this; see our guide to two-factor authentication and the overview of hardware security keys.
• Android-only alternative with more control. If you only use Android and want more control over the backup location, Aegis is worth a look.

Who should use it

2FAS suits people on iPhone and Android who want an open, free app that is easy to set up, does not require an account and lets them leave later through export. It is also a sensible choice for households that mix iOS and Android and for people who use a browser extension to avoid typing codes. For a broader comparison, see our list of the best authenticator apps.

How we assessed it

This review is based on 2FAS’s website, its published documentation and open-source repository descriptions, and on public information about its features. We did not run lab tests, audit the code or time anything, and we do not give star ratings. Statements about encryption and data handling are the project’s own. Features can differ slightly between iOS and Android and change with app updates, so check the current store listing for your platform.

Getting started in five steps

1. Install the app from your phone’s official store and open it without creating an account.
2. Turn on the encrypted backup and choose a strong backup password, then store that password in your password manager.
3. Add accounts by scanning the QR code each service shows when you enable two-factor authentication.
4. Save each service’s backup codes somewhere separate from the phone.
5. Restore the backup on a second device once, so you know it works before you need it.

Verdict

2FAS Auth does what an authenticator should: it keeps your codes private, lets you back them up with encryption and lets you take them with you. It is simple, free and open. The missing desktop app and the backup-based approach to moving between devices are its main compromises. Set up the backup first, test it, and keep the one-time recovery codes of your important accounts in a separate place.