Every 2FA app on a store listing claims to be secure. The question that actually matters for this site is narrower: what happens to your TOTP secrets if the vendor gets breached, gets subpoenaed, or just shuts down the desktop client with three months’ notice? That’s the audit-scope test, not “does it have a nice icon.”
Why Authy Fell Off This List
Authy used to be the default recommendation. It isn’t anymore, and the reason isn’t nostalgia for open source — it’s a track record. Authy has been hit by repeated data exposures, including an unauthenticated API endpoint in mid-2024 that let attackers enumerate phone numbers tied to Authy accounts. On top of that, Twilio (Authy’s owner) discontinued the Authy desktop apps, pushing everyone back to mobile-only. Neither incident touched your actual TOTP codes, but both show a vendor that treats account-recovery infrastructure as an afterthought — exactly the layer a 2FA app is supposed to protect.
The Three Apps Worth Your Time
Aegis (Android only). No account, no cloud sync by default, fully open source, and your vault is encrypted locally with AES-256-GCM behind a password you choose. If you want a 2FA app that simply cannot leak your secrets to a third-party server because it never sends them anywhere, Aegis is the honest answer. The tradeoff: you own backup and restore, and there’s no iOS build.
Ente Auth (cross-platform). Open source, end-to-end encrypted cloud sync, and it runs on Android, iOS, Windows, macOS, Linux, and the web — so it’s the realistic pick if you switch phones often or want a desktop copy without exporting a plaintext backup file. Because the sync layer is E2E encrypted, Ente’s own servers can’t read your codes even if compelled to hand data over, which is the same trust model this site expects from a VPN’s no-logs claim.
2FAS (cross-platform). Open source, free, and its cloud backup rides on your own Google Drive or iCloud account rather than a vendor-run server — so there’s no central database of everyone’s 2FA vaults to breach in the first place. Setup is close to zero-friction, which makes it the pick for someone migrating a household off Authy this weekend.
Bitwarden’s built-in TOTP. If you already pay for Bitwarden Premium, it can store and generate TOTP codes inside the same encrypted vault as your passwords. Convenient, but it collapses “something you know” and “something you have” into one login — if your Bitwarden master password leaks, both factors go with it. Fine as a secondary vault for low-stakes accounts; not a replacement for a standalone app on your bank or email.
Where a Hardware Key Still Wins
None of the above defend against a real-time phishing proxy that relays your TOTP code to the attacker within its 30-second window — TOTP is phishing-resistant in theory, not in practice. A FIDO2/WebAuthn hardware key (YubiKey is the common name here) binds the login to the actual domain, so a lookalike phishing page simply can’t complete the handshake. If an account would genuinely hurt you if compromised — primary email, your password manager, your bank — pair a hardware key with one of the apps above rather than treating TOTP as the ceiling.
| App | Open source | Cloud sync | Platforms | Best for |
|---|---|---|---|---|
| Aegis | Yes | None by default | Android only | Maximum control, no vendor trust required |
| Ente Auth | Yes | E2E encrypted (Ente servers) | Android/iOS/desktop/web | Multi-device households |
| 2FAS | Yes | Your own Drive/iCloud | Android/iOS | Fast migration off Authy |
| Bitwarden Auth | Partial | Encrypted vault sync | All major platforms | Secondary/low-stakes accounts only |
| Authy | No | Vendor-run | Mobile only (desktop retired) | Not recommended — migrate off |
Migration Mistakes That Lock You Out
- Not saving recovery/backup codes before switching apps. Every service issues one-time backup codes at 2FA setup — if you never saved them, re-enrolling in a new app means going through each service’s account-recovery flow one at a time.
- Screenshotting QR codes instead of using each app’s export/import. A screenshot in your camera roll defeats the entire point of not storing secrets in a syncable, unencrypted location.
- Migrating your bank and primary email last. Do the highest-stakes accounts first, while you still have the old app installed as a fallback, not last when you’re tired of the process.
FAQ
Is SMS 2FA better than no 2FA at all? Yes — SIM-swap risk is real but still a smaller attack surface than nothing. Treat it as a last resort, not a target state.
Can I run more than one 2FA app? Yes, and it’s a reasonable way to split risk — for example Aegis for sensitive personal accounts and 2FAS for everything else, so a single app’s failure doesn’t strand every account at once.
Do I need a hardware key if I already use an open-source app? Only for accounts where a phishing-proxy attack is a realistic threat model — primary email and password manager are the two most people should prioritize.
What happens if I lose my phone with the 2FA app installed? This is exactly what backup codes and an app’s own encrypted export are for — set both up at enrollment, not after you’ve already lost the device.
Verdict
For most readers of this site, Ente Auth is the balanced default — open source, E2E encrypted, and it doesn’t force a single-platform lock-in. Android purists who want zero cloud dependency should run Aegis instead. Whatever you land on, the one universal move is getting off Authy: the breach history and the desktop shutdown both point the same direction.
