Authenticator apps: which ones back up and which leave you locked out
No authenticator app has an affiliate program: they're free, with nothing to sell us. What does change between them is whether they back up your codes or whether, when you lose your phone, you lose them with it.
None of the apps on this page has an affiliate program: there are no commissionable links here, only our own assessment. We will never ask you for a password.
What does an authenticator app do for your recovery?
It generates the TOTP codes you're asked for when signing into an account with two-step verification. The risk isn't the code itself: it's where the secret that generates it lives. If it only lives on your phone, with no backup anywhere else, losing your phone means losing access to every account that app protected, unless you have the backup codes saved separately.
What to look at when choosing
- Does it back up your codes automatically, or does it depend on you exporting them by hand?
- Is the backup end-to-end encrypted, or only protected by your Google or Microsoft account?
- Does it work on both iPhone and Android, in case you switch systems?
- Does it have a desktop version, in case you need to sign in from a computer?
- Will you be able to re-enable 2FA account by account if you switch apps?
Comparison
| App | What happens to your codes if you lose your phone | Platforms | Who it's for |
|---|---|---|---|
| Google Authenticator | Syncs to your Google account since 2023, with no manual action; still, no end-to-end encryption | iOS, Android | The best default value if you already depend on Google |
| Microsoft Authenticator | Backup tied to your Microsoft account, but only restores within the same system (iOS→iOS or Android→Android) | iOS, Android | Fine if you don't switch ecosystems; bad if you move from iPhone to Android |
| Ente Auth | Automatic end-to-end encrypted backup and multi-device sync with a free Ente account | iOS, Android, desktop, web | The best real multi-platform coverage |
| 2FAS | Export/import to a password-encrypted file; optional sync via your own Google Drive account | iOS, Android + browser extension | A solid safety net, with no 2FAS-owned account |
| Aegis Authenticator | Manual export to a file (plain text or AES-256 encrypted), no automatic sync | Android only | Anyone who wants full control and doesn't have an iPhone |
| Proton Authenticator | End-to-end encrypted backup and sync; no account needed if you use a single device | iOS, Android, desktop | Good coverage and an already-known brand for Proton Mail or VPN users |
What if I keep my codes inside my password manager?
That's another option, and not a bad one: managers like Bitwarden or 1Password can store the same TOTP secret an authenticator app would, alongside that account's password. The upside is everything stays in one place with a single backup to manage; the downside is exactly the opposite: if your manager and your second factor live in the same place, you lose the idea of "two separate factors," and if the manager gets locked, your codes get locked too. For your email or the manager itself, a separate app is better; for secondary accounts, putting it all in the manager is reasonable.
Our default pick
Ente Auth or Proton Authenticator: both back up end-to-end encrypted and genuinely cover iPhone, Android and desktop, so switching phones won't lock you out. If you're already in Google's ecosystem and want the simplest option, Google Authenticator syncs just by having the account, although that backup isn't end-to-end encrypted.
About Authy: we don't recommend it. Twilio, its own parent company, discontinued the desktop apps in 2024 and told users to migrate to other apps or managers — a clear sign the product is in decline.
Common mistakes
The most frequent one: installing an app "only on the phone," with no backup or backup codes saved elsewhere, and finding out the problem the day the phone breaks or gets lost. The second: confusing "backs up to the cloud" with "is end-to-end encrypted": they're not the same, and Google Authenticator is the textbook example of the difference.
The third is more subtle: switching authenticator apps (for example, from Google Authenticator to Ente Auth) without first turning off 2FA on each old account and turning it back on with the new app. Apps don't "inherit" codes from another one automatically unless they export and import the same file; if you just install the new app and start using it, the account is still waiting for codes from the old one.
Official sources: Google — Authenticator · Microsoft Authenticator