Here is the open secret of the authenticator-app market: they all produce exactly the same codes. TOTP - The algorithm behind those six digits that refresh every 30 seconds - Is an open standard (RFC 6238), and any compliant app fed the same secret key will display the same number at the same moment. Google Authenticator has no better math than a weekend open-source project. You can prove it yourself by pasting a Base32 secret into our in-browser TOTP code generator and watching it tick in lockstep with your phone.
So choosing an authenticator app is not about code quality. It's about everything wrapped around the codes: what happens when your phone is lost, whether secrets sync across devices, whether the app locks behind a fingerprint, and whether you can ever export your secrets and leave. Those features differ dramatically - And picking wrong is how people end up locked out of twenty accounts at once.
The features that actually matter
Backup and sync. TOTP secrets live on your phone. Without a backup mechanism, a broken phone silently destroys every one of them, leaving you to recover each account individually through fallback methods. This is the single biggest differentiator between apps, and the reason the "no cloud, maximum security" stance backfires for most people - The practical risk of losing your own access dwarfs the theoretical risk of encrypted cloud sync. Whatever app you choose, saving each service's 2FA backup codes remains your safety net of last resort.
App-level lock. Can the app itself require Face ID, fingerprint, or a PIN before showing codes? Without it, anyone holding your unlocked phone reads every code.
Export. Some apps let you export all secrets (as QR codes or files); others hold them hostage. You'll care exactly once - The day you switch apps or platforms - And you'll care a lot.
Extras. Push-based approval, encrypted password storage, watch apps, browser extensions. Nice, rarely decisive.
The major apps, head to head
| App | Backup/sync | End-to-end encrypted sync | App lock | Export | Notable |
|---|---|---|---|---|---|
| Google Authenticator | Google Account sync | Yes (since 2023 update) | Yes (biometric) | QR transfer | Simplest mainstream choice |
| Microsoft Authenticator | Cloud backup (MS/iCloud) | Partial (backup encrypted) | Yes | No general export | Push approval for MS accounts |
| Authy (Twilio) | Cloud sync, multi-device | Yes (backup password) | Yes | No official export | Desktop app retired in 2024 |
| 2FAS | iCloud/Drive backup | Yes (optional password) | Yes | Yes (file) | Open source, no account needed |
| Ente Auth | Cross-platform sync | Yes | Yes | Yes | Open source, web + desktop apps |
| Aegis (Android) | Local encrypted vault/file | n/a (local) | Yes | Yes | Power-user favorite, Android only |
| Password manager built-ins | Vault sync | Yes (vault encryption) | Yes | Yes | Codes live beside passwords |
A few footnotes the table can't hold. Google Authenticator's 2023 overhaul added account sync and finally, after criticism, end-to-end encryption for synced secrets - Transforming it from the app most famous for eating codes with dead phones into a reasonable default. Microsoft Authenticator shines if you live in Microsoft's world, adding number-matching push approvals that resist the prompt-bombing tricks plaguing simple "Approve?" buttons. Authy pioneered multi-device sync but has drawn criticism for lacking a clean export path, and its 2022 parent-company breach at Twilio (which exposed some Authy accounts to device enrollment attempts) is a reminder that the vendor behind the app is part of your threat model.
The open-source options - 2FAS, Ente Auth, and Aegis - Have matured into genuine first-choice contenders, combining encrypted backups with the export freedom the big names withhold.
Rule of thumb: choose an app you can back up and leave. Encrypted sync protects you from a lost phone; export support protects you from the app itself.
Should your password manager hold your 2FA codes too?
Most major password managers can store TOTP secrets and autofill the codes alongside your passwords, and a Password Wallet that keeps credentials organized in one encrypted place is genuinely convenient. Purists object: if one vault holds both factors, isn't that just one factor again?
It's a fair point with a nuanced answer. A vault breach would indeed expose both password and TOTP seed. But the attacks 2FA most commonly defeats - Credential stuffing from old breaches, bulk phishing of passwords alone - Are still blocked, because the attacker hitting a login page with a leaked password doesn't have your vault. For most people, codes-in-the-manager is a large net win over no 2FA or SMS codes. For your highest-value accounts (primary email, the vault itself, banking), keep the second factor genuinely separate: a standalone authenticator app, or better, a hardware security key, which no phishing page can trick regardless of where your other secrets live.
Switching apps without locking yourself out
Migration is where authenticator choices bite. The safe procedure:
- Install the new app first and set up its backup mechanism before adding anything.
- Export/transfer what you can. Google Authenticator generates migration QR codes; 2FAS, Aegis, and Ente exchange files. Scan or import into the new app.
- Re-enroll what you can't export. For locked-in apps, log into each website, disable and re-enable 2FA to get a fresh QR code, and scan with the new app. Tedious but bulletproof.
- Verify codes work in the new app for every account - Actually log in, don't assume.
- Only then wipe the old app.
While you're touching every account anyway, it's an ideal moment to fix weak and reused passwords and confirm each account's recovery options are current - The full sequence is in our two-factor authentication setup guide.
Because TOTP is an open standard, every site that shows a QR code works with every app in the table above. You're never locked into an app by the websites - Only by the app's own export policy.
What about SMS, and what about passkeys?
An authenticator app - Any of them - Comfortably beats text-message codes, which NIST SP 800-63B has discouraged since 2017 due to SIM-swapping and interception; the details are in our comparison of TOTP versus SMS 2FA. At the other end, passkeys and hardware keys resist phishing in ways no six-digit code can, since a relayed TOTP code is still a valid code. The realistic 2026 posture: passkeys where sites offer them, an authenticator app everywhere else, SMS nowhere you can avoid it.
For developers on the other side of the QR code, adding TOTP to your own login flow is straightforward - The enrollment, code verification, and rate-limiting can be handled by our 2FA API - And every user who scans your QR code brings whichever app they already trust.
FAQ
Which authenticator app should most people pick?
If you want zero friction: Google or Microsoft Authenticator, both now with encrypted backup. If you value open source and export freedom: 2FAS or Ente Auth, which sync across devices and let your secrets leave. If you're on Android and want full local control: Aegis. Any of these beats SMS by a wide margin; the worst choice is an app with no backup configured.
If I get a new phone, do my codes move automatically?
Only if you enabled the app's sync or backup before retiring the old phone. Synced apps (Google, Authy, 2FAS, Ente) restore on sign-in; local-only setups need an explicit transfer or file restore. Do the transfer while the old phone still works - Afterward, verify a login or two before wiping it.
Can I use two authenticator apps at the same time?
Yes. A TOTP secret is just data - Scan the same QR code with two apps during enrollment and both will generate identical valid codes forever. Running a second app on a tablet or a partner's device is a legitimate DIY backup strategy for your most critical accounts.
Do authenticator codes work without internet or cell service?
Completely. TOTP combines the stored secret with the current time, so codes generate in airplane mode, abroad, or on a phone with no SIM. The only requirement is a roughly accurate clock, which phones keep automatically.
Is it bad that my authenticator app is made by Google or Microsoft?
Not inherently - Both companies secure these apps well, and end-to-end encrypted sync means even the vendor can't read synced secrets in Google's current implementation. The trade-off is account coupling: access to your platform account becomes the path to your codes. Protect that platform account with the strongest factor you own, and the coupling works for you rather than against you.