Best authenticator apps in 2026: 2FAS, Aegis, Ente Auth

The best authenticator apps for most people are open-source ones that encrypt your backup and let you export your codes: Ente Auth for several platforms, 2FAS for iPhone and Android, Aegis for Android only. All three are free, none requires you to trust a big-tech account, and each lets you move to another app later. This ranking is an editorial assessment based on vendor documentation, published source-code information and feature lists as of October 2026, not a laboratory test. If you want the basics first, read our explanation of TOTP codes and the guide to two-factor authentication.

What matters when you choose

1. Encrypted backup and sync. If your phone breaks and your codes were only on it, you are locked out of every account that depends on them. A backup that is encrypted with your own password is the single most useful feature.
2. Export. You should be able to leave. A good app exports your codes in a file or migration format that another app can read.
3. Open source. Public code lets researchers inspect how the secrets are handled. It is not a guarantee, but it is a good sign.
4. Platforms. Do you need iPhone, Android, desktop or a browser?
5. Cost and origin. Who runs the app, and does it need an account?

Our picks at a glance

App	Platforms	Backup and sync	Open source	Origin	Cost
Ente Auth	iOS, Android, macOS, Windows, Linux, web	End-to-end encrypted cloud backup and sync, works offline without an account	Yes (AGPL-3.0)	Open-source project	Free
2FAS Auth	iOS, Android, browser extension, Apple Watch	Encrypted backup to your own cloud account, manual export, no account required	Yes	Poland	Free
Aegis Authenticator	Android only	Encrypted vault, automatic backups to a location you choose, encrypted or plain export	Yes (GPL v3)	Open source, Netherlands	Free

1. Ente Auth: best for several devices

Ente Auth runs on iOS, Android, macOS, Windows, Linux and in the browser, so your codes follow you across devices. Its backups are end-to-end encrypted, it also works offline without an account, and it supports import from other authenticators and export of your data. Ente says its code and cryptography have been audited externally, and it publishes the source under the AGPL-3.0 licence. Everything is free. If you want a computer app as well as a phone app, this is the first app to try.

2. 2FAS Auth: best for a simple setup on iPhone and Android

2FAS is a free open-source authenticator from Poland for iOS and Android. It needs no account, works offline and lets you enable encrypted backup to your own cloud account or export manually, optionally with a password. Tokens can be organised with groups, icons and labels, the app can be locked with a PIN, and there are an optional browser extension and Apple Watch support. It is a good default for people who want an app that is easy to set up and still open.

3. Aegis Authenticator: best for Android users

Aegis is a free, GPL v3 open-source app for Android only. Your vault can be encrypted with a password, it makes automatic backups to a location you choose (for example a cloud folder through Android’s file system), and it exports in encrypted or plain form. It supports the standard HOTP and TOTP algorithms and includes an audit log of vault events. If you are on Android and want the most control, Aegis is hard to beat. It has no iPhone version, which rules it out for mixed households.

Apps we do not rank, and why

• Google Authenticator works with all standard services and has added syncing through a Google Account. At launch in 2023, that sync was not end-to-end encrypted, so Google could technically read the secrets. Check Google’s current documentation if you use it. For a European privacy-focused setup, an app that encrypts with your own password is the more cautious choice.
• Microsoft Authenticator supports standard codes and Microsoft account sign-in prompts. In 2025 Microsoft removed password storage and autofill from the app, which is another reminder that bundled features can disappear. It remains a sensible choice mostly for people who live in Microsoft 365.
• Authy offered easy multi-device sync, but Twilio ended the desktop apps for Windows, macOS and Linux (end of life in March 2024, shutdown later in 2024). Mobile apps continue. If you use Authy, make sure you have another way to access your accounts and consider migrating.
• Password manager TOTP. Many password managers can store codes too. That is convenient but puts password and code in one place; see our overview of the best password managers and decide whether you accept that trade-off.

How we chose

We started with the open-source authenticators that offer encrypted backup and a way to export your codes, then compared platforms, cost, origin and what each project says about its security. We did not run lab tests, measure speed or audit code, and we do not give star ratings. Statements about audits and encryption are the vendors’ own and are labelled as such. Features and prices change, so check each app’s current documentation before you commit.

Switching apps without locking yourself out

Moving to a new authenticator is the moment people lose access, so do it in a fixed order. First, note which accounts use codes and make sure you have the backup codes for the important ones. Second, export from the old app, encrypted if the app allows it, and import into the new app. Third, log in to a few test accounts and confirm that the new app’s codes are accepted. Only then delete the old app and the plain export file. If a service lets you add a second authenticator or a passkey, do that too, so one lost phone is never the end of the story. For the underlying idea, see our guide to account recovery.

Authenticator apps are not the end of the road

TOTP codes protect you from stolen passwords and from SMS attacks such as SIM swapping, but a convincing fake website can still trick you into typing the code. Passkeys and hardware keys check the website address and resist that attack. Where a service offers a passkey or a security key, use it, and keep the authenticator app as a fallback; our overview of hardware security keys lists good options.

Setting up an app the safe way

• Save the backup codes each service shows when you turn on 2FA, and store them separately: see backup codes.
• Turn on encrypted backup before you add many accounts, then test a restore on a second device.
• Do not keep the only copy of your codes on a phone you may lose.
• Leave SMS off where you can choose something better (see the risks of SMS codes).

Verdict

Choose Ente Auth if you need several platforms, 2FAS for an easy iPhone and Android app, and Aegis if you are Android-only and want maximum control. All three keep you in charge of your codes. Whichever you pick, set up the encrypted backup today, not after the phone is lost.