# Authenticator apps compared: Google, Microsoft and the alternatives

> Google Authenticator, Microsoft Authenticator, Authy, 2FAS, Aegis, Ente Auth, Proton and Bitwarden Authenticator compared on backup, transfer and export.

Every **authenticator app** generates the same kind of short-lived login codes, so the real differences lie elsewhere: whether your codes are backed up, whether that backup is end-to-end encrypted, whether you can move them to a new phone or another app, and whether the app runs on a computer. Those details decide whether a lost phone is a minor problem or a locked-out week.

**Key takeaways**

1. Google Authenticator can sync codes to your Google Account, which Google says are encrypted in transit and at rest, and can transfer them to a new phone with a QR code.
2. Twilio ended Authy's desktop apps on March 19, 2024, and Authy has no export feature, so leaving it means re-enrolling each account.
3. Ente Auth and Proton Authenticator offer optional end-to-end encrypted sync and desktop apps, and both are free and open source.


## Which authenticator app should you use?

Any reputable authenticator app will protect your accounts; what separates them is what happens when your phone is lost, broken, or replaced. Pick an app that backs up your codes, or at least lets you export them, and that you can reach from the devices you actually use. This page is part of [our guide to adding a second factor to your logins](/guides/account-security/passkeys-and-2fa/), and Google's own [help page for Google Authenticator](https://support.google.com/accounts/answer/1066447) shows the questions to ask of any app: sync, transfer, and what happens without either.

An authenticator app stores a secret shared with each website when you set up two-factor authentication, usually by scanning a QR code, and uses it to generate short-lived codes. The codes work without a mobile signal, which is one reason they are safer than codes sent by text message.

### Eight apps on the points that matter

What each provider says on its own pages, checked on November 10, 2026. All the apps listed are free.

| App | Platforms | Backup or sync | End-to-end encrypted, per the provider | Export | Open source |
|---|---|---|---|---|---|
| Google Authenticator | Android, iOS | Optional, to your Google Account | No: “in transit and at rest” | QR code transfer | No |
| Microsoft Authenticator | Android, iOS | iCloud on iOS; Microsoft account on Android | Not stated | Not stated | Not stated |
| Twilio Authy | Android, iOS | Authy servers, with a backup password | Yes | None | Not stated |
| 2FAS Auth | Android, iOS, browser extension | iCloud or Google Drive | Encrypted backup | File | Yes |
| Aegis | Android only | Local file you choose | Encrypted vault | File, plain or encrypted | Yes |
| Ente Auth | Android, iOS, web, macOS, Windows, Linux | Optional Ente account | Yes, audited | Encrypted file | Yes |
| Proton Authenticator | Android, iOS, macOS, Windows, Linux | Optional Proton account or iCloud | Yes | Yes | Announced as open source |
| Bitwarden Authenticator | Android, iOS | Your phone's cloud backup | Local database, unencrypted per its help page | JSON or CSV | Yes |

Apple's Passwords app, since iOS 18 and macOS Sequoia, also generates verification codes and syncs them through iCloud Keychain, which Apple says is end-to-end encrypted.

### Google Authenticator

Since April 2023, Google Authenticator can sync your codes to your Google Account: sign in on a new phone and they appear. Google says the codes are encrypted in transit and at rest, which is not the same as end-to-end encryption. You can also use the app without an account, in which case the codes stay on the device and move to a new phone only through the export QR code. If you lose a phone whose codes were not synced, Google's advice is blunt: visit every site that uses the app, remove the old codes, and set up the new device.

### Microsoft Authenticator

Microsoft Authenticator backs up one-time codes to iCloud on an iPhone and to a personal Microsoft account on Android. Microsoft says that, starting in January 2027, Android backups will move to Google One. A backup made on iOS cannot be restored on Android, and the reverse is also true, and work or school accounts are not backed up. After restoring, you must sign in to each account again. Microsoft also asks you to install it, or Outlook for Android, before you can remove the password from a personal Microsoft account.

### Twilio Authy

Authy was popular for its multi-device sync, but Twilio ended its desktop apps for Windows, macOS, and Linux on [March 19, 2024](https://support.twilio.com/hc/en-us/articles/22771146070299-User-guide-End-of-Life-EOL-for-Twilio-Authy-Desktop-app). Authy has no export feature: leaving means turning two-factor authentication off and on again, account by account, in the new app. Its backups are encrypted with a password that Twilio cannot recover. In July 2024, Twilio reported that attackers had identified phone numbers linked to Authy accounts through an unauthenticated endpoint, and said the accounts themselves were not compromised.

### The independent apps

- **2FAS Auth** works on iPhone and Android, backs up to your own iCloud or Google Drive, adds a browser extension that works with the phone app, and publishes its code under the GPL.
- **Aegis** runs only on Android and has no internet access at all: backups go to a file or folder you choose, and exports can be plain or encrypted.
- **Ente Auth** runs everywhere, including Windows, macOS, Linux, and the web, and encrypts codes on your device before syncing them; Ente says its cryptography has been externally audited. Its [help pages](https://ente.com/help/auth/faq/) also remind you that an authenticator app does not generate a site's own backup codes.
- **Proton Authenticator**, launched in July 2025, needs no account, offers optional end-to-end encrypted sync, and imports from other apps.
- **Bitwarden Authenticator** is mobile only. Its [help page](https://bitwarden.com/help/bitwarden-authenticator/) says codes are kept in a local unencrypted database and protected through your phone's own backup, which contradicts its product page's mention of end-to-end encryption; the help page is the more precise of the two.

### How to choose

1. **You use one Google or Apple ecosystem:** Google Authenticator with sync, or Apple Passwords, keeps things simple.
2. **You want codes on your computer too:** Ente Auth or Proton Authenticator.
3. **You want end-to-end encrypted backups:** Ente Auth, Proton Authenticator, or Authy, keeping in mind that Authy cannot export.
4. **You use Microsoft 365 at work:** your employer may require Microsoft Authenticator; it can sit alongside another app.
5. **Whatever you choose:** keep each site's backup codes somewhere offline, because no app can recreate them.

### Before you pick a method at all

An app is one option among several. If you are still deciding between text messages, an app, and a hardware key, start with [the comparison of second factors](/guides/account-security/passkeys-and-2fa/choose-a-second-factor/).

### When the phone changes

Moving codes to a new phone is where most people get locked out. Our step-by-step guide to [keeping your codes when you replace or lose a phone](/guides/account-security/passkeys-and-2fa/new-or-lost-phone/) covers each app and platform.