saasrankedSoftware, ranked on the facts

Security & Privacy

Best authenticator apps

Generate two-factor codes for your accounts and keep them safe if you lose or replace your phone. 12 authenticator apps, ranked by points out of 100.

Facts checked 8 Oct 2026 · How we score authenticator apps

In short

  1. 1
    Ente AuthPeople who want encrypted sync, open source and a web view of their codes
    91/100
    $0cost with backup on two devices
  2. 2
    Proton AuthenticatorPeople who want encrypted sync and a Windows or Linux app
    79/100
    $0cost with backup on two devices
  3. 3
    Zoho OneAuthPeople who want free encrypted backup and the same codes on a phone and a computer
    74/100
    $0cost with backup on two devices
  4. 4
    2FAS AuthiPhone and Android users who want a free app without an account
    73/100
    $0cost with backup on two devices
  5. 5
    StratumAndroid users who want an offline, open-source app they fully control
    60/100
    Not publishedcost with backup on two devices
  6. 6
    Bitwarden AuthenticatorPhone users who want a free, audited, open-source code app with no sign-up
    54/100
    Not publishedcost with backup on two devices
  7. 7
    Aegis AuthenticatorAndroid users who want an open-source app and control over where backups go
    48/100
    Not publishedcost with backup on two devices
  8. 8
    Google AuthenticatorPeople who want codes on several phones and already use a Google Account
    46/100
    $0cost with backup on two devices
  9. 9
    FreeOTPPeople who want a plain open-source app for HOTP and TOTP codes
    46/100
    Not publishedcost with backup on two devices
  10. 10
    AuthyPeople who want encrypted cloud backup and multiple devices, and accept giving a phone number
    43/100
    $0cost with backup on two devices
  11. 11
    LastPass AuthenticatorPeople who already use LastPass and want one app for push approval and codes
    39/100
    Not publishedcost with backup on two devices
  12. 12
    Microsoft AuthenticatorPeople who mainly protect Microsoft accounts and want sign-in approval prompts
    26/100
    Not publishedcost with backup on two devices

How the points add up

Points earned out of the points available in each part of the method.

ProductSecurity and trust
of 37		Backup and recovery
of 35		Systems
of 12		Features
of 12		Price
of 4		Total
Ente Auth3435126491
Proton Authenticator2735103479
Zoho OneAuth213586474
2FAS Auth243546473
Stratum242826060
Bitwarden Authenticator222840054
Aegis Authenticator122826048
Google Authenticator62943446
FreeOTP241543046
Authy181740443
LastPass Authenticator62346039
Microsoft Authenticator91043026

Each authenticator app in brief

1. Ente Auth

Ente Auth suits people who want free encrypted sync across phone, desktop and web, with open code and a recent public audit. It imports from nine named apps and exports encrypted files. The catch: Ente documents no public bug bounty, and its pages do not mention passkeys or push approval.

Best for: People who want encrypted sync, open source and a web view of their codes. Prices, facts and sources

2. Proton Authenticator

Proton Authenticator suits people who want codes on a phone and a desktop, with encrypted backup and no paid plan. It imports from several rival apps and exports your codes. The catch: Proton names no outside audit of this app yet, and Proton's pages do not mention passkeys, push approval or counter-based codes.

Best for: People who want encrypted sync and a Windows or Linux app. Prices, facts and sources

3. Zoho OneAuth

OneAuth suits people who want free encrypted backup and syncing across a phone and a computer. It also offers folders, push sign-in approval and an app lock. The catch: backup needs a Zoho account, and its pages publish no outside audit, source code or counter-based code support.

Best for: People who want free encrypted backup and the same codes on a phone and a computer. Prices, facts and sources

4. 2FAS Auth

2FAS Auth suits people with a phone who want a free, open-source app with no sign-up and backup in their own cloud. PIN or biometric lock, groups and search are included. The catch: it is phone-only, the backup password is optional, and its pages name no outside audit or bug bounty.

Best for: iPhone and Android users who want a free app without an account. Prices, facts and sources

5. Stratum

Stratum suits Android users who want an offline, open-source app with strong backup encryption and no sign-up. It supports TOTP, HOTP, categories and a password or biometric lock. The catch: it runs only on Android, has no cloud sync of its own, so cloud backup needs DAVx5, and publishes no audit or bug bounty.

Best for: Android users who want an offline, open-source app they fully control. Prices, facts and sources

6. Bitwarden Authenticator

Bitwarden Authenticator suits phone users who want a free app from a vendor that publishes mobile audit reports. It needs no account and imports from several other apps. The catch: backup depends on the phone's own cloud backup, there is no desktop app, and its bug bounty is private.

Best for: Phone users who want a free, audited, open-source code app with no sign-up. Prices, facts and sources

7. Aegis Authenticator

Aegis suits Android users who want free, open-source code and control over their backups. Backups can go to cloud storage you choose, and the vault is locked with a password you hold. The catch: it runs only on Android, and its pages publish no outside audit, bug bounty or multi-device sync.

Best for: Android users who want an open-source app and control over where backups go. Prices, facts and sources

8. Google Authenticator

Google Authenticator suits people who want free codes that follow them to a new phone through a Google Account. It also offers transfer by QR code and a no-account mode. The catch: Google's page describes encryption in transit and at rest only, the official app is closed source, and it runs on phones only.

Best for: People who want codes on several phones and already use a Google Account. Prices, facts and sources

9. FreeOTP

FreeOTP suits people who want a simple open-source app on Android or iOS that supports HOTP and TOTP. Backup uses Google or Apple device backups, with encryption. The catch: its pages describe no export or import, no folders or search, and no audit or bug bounty, and F-Droid warns of backup problems.

Best for: People who want a plain open-source app for HOTP and TOTP codes. Prices, facts and sources

10. Authy

Authy suits people who want encrypted cloud backup and the same codes on several devices, for free. It has an app lock and offline codes. The catch: an account needs your phone number, only phone apps are listed, and Twilio reported two security incidents involving Authy in 2022 and 2024.

Best for: People who want encrypted cloud backup and multiple devices, and accept giving a phone number. Prices, facts and sources

11. LastPass Authenticator

LastPass Authenticator suits people who already log in to LastPass and want push approval plus codes for other sites in one free app. It covers backup, a biometric lock, import and export. The catch: LastPass does not say who holds the backup key, a LastPass page limits Free-plan users to passwordless login with the app, and its pages name no audit firm, passkeys or HOTP.

Best for: People who already use LastPass and want one app for push approval and codes. Prices, facts and sources

12. Microsoft Authenticator

Microsoft Authenticator suits people whose main accounts are Microsoft ones, since it adds approval prompts and codes for other sites on iOS and Android. It has an app lock and a public bounty. The catch: Microsoft does not document a user-held backup key, and the app is mobile only.

Best for: People who mainly protect Microsoft accounts and want sign-in approval prompts. Prices, facts and sources

Every fact, side by side

Each row is one rule of the method and the points it is worth. "–" means the vendor does not publish it, which earns nothing.

Rule (points)Ente AuthProton AuthenticatorZoho OneAuth2FAS AuthStratumBitwarden AuthenticatorAegis AuthenticatorGoogle AuthenticatorFreeOTPAuthyLastPass AuthenticatorMicrosoft Authenticator
End-to-end encrypted backup (12)YesYesYesYesYes–––YesYes––
Independent audit, 2023 or later (10)Yes––––Yes––––––
Open-source apps (6)YesYes–YesYesYesYesNoYes–––
Public bug bounty (3)–YesYes––No–––––Yes
App lock (6)YesYesYesYesYesYesYesYesYesYesYesYes
Cloud backup or sync (10)YesYesYesYesYesYesYesYesYesYesYesYes
Same codes on several devices (7)YesYesYesYes–––Yes–Yes––
Export all accounts (7)YesYesYesYesYesYesYesYes––Yes–
Import from other apps (6)YesYesYesYesYesYesYes–––Yes–
Works without an account (5)YesYesYesYesYesYesYesYesYesNo––
Apps (12)6 of 65 of 64 of 62 of 61 of 62 of 61 of 62 of 62 of 62 of 62 of 62 of 6
Stores passkeys (3)––––––––––––
Sign-in approval prompts (3)––Yes–No–––––YesYes
Counter-based (HOTP) codes (3)Yes––YesYes–Yes–Yes–––
Folders, tags or search (3)YesYesYesYesYes–YesYes––Yes–
Cost with backup on two devices (4)$0$0$0$0–––$0–$0––

Head to head

We read each vendor's own pages, record every fact with its source and date, and score it by the rules on how we score authenticator apps. A tie goes to the lower price. Standalone two-factor code apps for individuals, free or paid. Most run on a phone, so a Windows app is scored, not required. Password managers, hardware keys and business single sign-on tools are left out. "On at least one plan" counts only plans for individuals. Vendor help pages and public source repositories count as documentation. Vendor claims about speed or quality are shown on product pages but never scored. Prices are in US dollars before tax.