--- title: 2FAS Auth canonical: https://saasranked.com/software/2fas-auth/ category: Authenticator Apps points: 73 rank: 4 of 12 facts_checked: 2026-10-08 --- # 2FAS Auth Free, open-source phone authenticator with backup to your own iCloud or Google Drive and no account. 73 points out of 100. #4 of 12 authenticator apps. Vendor: Two Factor Authentication Service, Inc.. Website: https://2fas.com/auth/ - The app is free, works offline and needs no account [1]. - It runs on iOS and Android only; there is no desktop app [2]. - Backups go to your iCloud or Google Drive and can be protected with a password you choose [1][3]. - Code is open source under GPL-3.0 [5][6]. - It supports TOTP, HOTP and Steam codes, and imports from five other apps plus its own .2fas files [8][9]. Verdict: 2FAS Auth suits people with a phone who want a free, open-source app with no sign-up and backup in their own cloud [1][3][5]. PIN or biometric lock, groups and search are included [9]. The catch: it is phone-only, the backup password is optional, and its pages name no outside audit or bug bounty [2][3][10][11]. Best for: iPhone and Android users who want a free app without an account. ## Points | Criterion | Line | Value | Points | Note | |---|---|---|---|---| | Security and trust | End-to-end encrypted backup | Yes | 12/12 | The page says cloud sync is end-to-end encrypted by default and a backup can be encrypted with your own password. The password is optional [3][4]. | | Security and trust | Independent audit, 2023 or later | Not published | 0/10 | Not published on the vendor's about page or security policy [10][11]. | | Security and trust | Open-source apps | Yes | 6/6 | Android and iOS repositories are licensed under the GNU GPL v3.0 [5][6]. | | Security and trust | Public bug bounty | Not published | 0/3 | Not published; the security policy only covers private reporting by email [10]. | | Security and trust | App lock | Yes | 6/6 | A 4- or 6-digit PIN, with biometric unlock after a PIN is set [9]. | | Backup and recovery | Cloud backup or sync | Yes | 10/10 | Optional sync to your personal iCloud or Google Drive [1]. | | Backup and recovery | Same codes on several devices | Yes | 7/7 | Connect the same iCloud or Google Drive account on each device; cross-platform needs a backup file [7]. | | Backup and recovery | Export all accounts | Yes | 7/7 | Export a .2fas backup file of all tokens, with or without a password [9]. | | Backup and recovery | Import from other apps | Yes | 6/6 | Imports from Aegis, Raivo, LastPass, Stratum, Google Authenticator and .2fas files [8]. | | Backup and recovery | Works without an account | Yes | 5/5 | The app page says it does not require an account to use [1]. | | Systems | Apps | iOS, Android | 4/12 | Download page lists iOS and Android apps and browser extensions only [2]. | | Features | Stores passkeys | Not published | 0/3 | Not published on the vendor's app page and tutorial [1][9]. | | Features | Sign-in approval prompts | Not published | 0/3 | Not published as sign-in approval; push is used only to pair the browser extension [1]. | | Features | Counter-based (HOTP) codes | Yes | 3/3 | The repository README says the app supports TOTP and HOTP [5]. | | Features | Folders, tags or search | Yes | 3/3 | Unlimited groups, search by service name and manual or A-Z sorting [9]. | | Price | Cost with backup on two devices | $0 | 4/4 | Free app; backup and two-device sync use your own cloud account [1][7]. | ## Plans | Plan | Price | Per month (USD) | |---|---|---| | Free | Free [1] | $0 | ## Strengths - Free, anonymous and usable offline [1]. - Open source under GPL-3.0 [5][6]. - Backup to iCloud or Google Drive, with an optional password [1][3]. - Imports from Aegis, Raivo, LastPass, Stratum and Google Authenticator, plus its own .2fas files [8]. - Supports TOTP, HOTP and Steam codes, groups, search and a PIN or biometric lock [9]. ## Limits - Apps exist only for iOS and Android [2]. - The password on a backup is optional; an export without one is unencrypted [9]. - Moving codes between iOS and Android needs an exported file, not cloud sync [7]. - No outside audit or bug bounty is named on its pages [10][11]. ## Vendor claims (not scored) - 2FAS says the app is 100% free and works offline [1]. ## Sources 1. [2FAS Auth](https://2fas.com/auth/), 2FAS, accessed 2026-10-08 2. [Download 2FAS](https://2fas.com/download/), 2FAS, accessed 2026-10-08 3. [Is 2FAS backup safe?](https://2fas.com/support/2fas-auth-security-privacy/is-2fas-backup-safe/), 2FAS, accessed 2026-10-08 4. [Is 2FAS end-to-end encrypted?](https://2fas.com/support/2fas-auth-security-privacy/is-2fas-end-to-end-encrypted/), 2FAS, accessed 2026-10-08 5. [twofas/2fas-android](https://github.com/twofas/2fas-android), GitHub, accessed 2026-10-08 6. [twofas/2fas-ios](https://github.com/twofas/2fas-ios), GitHub, accessed 2026-10-08 7. [How to sync more devices with 2FAS](https://2fas.com/support/2fas-auth-mobile-app/how-to-use-sync-more-devices-with-2fas/), 2FAS, accessed 2026-10-08 8. [Which imports are supported in the 2FAS app?](https://2fas.com/support/2fas-auth-mobile-app/which-imports-are-supported-in-the-2fas-app/), 2FAS, accessed 2026-10-08 9. [2FAS Auth app tutorial](https://2fas.com/support/2fas-auth-mobile-app/2fas-auth-app-tutorial/), 2FAS, accessed 2026-10-08 10. [2FAS security policy](https://github.com/twofas/2fas-android/blob/main/SECURITY.md), GitHub, accessed 2026-10-08 11. [About 2FAS](https://2fas.com/about-us/), 2FAS, accessed 2026-10-08