authenticator app · Beem Development

Aegis Authenticator

Free, open-source Android app for two-factor codes, with an encrypted vault and automatic backups.

48/100

#7 of 12 authenticator apps
Facts checked 8 Oct 2026

In short

The app is free and runs on Android only, from Google Play and F-Droid^1,2.
Source code is public under GPL-3.0².
The vault is encrypted with AES-256-GCM, unlocked by a password or biometrics^2,3.
Automatic backups go to a location you choose, including cloud storage that Android can reach, such as Nextcloud^2,4.
It imports from 11 other authenticator apps, including Google Authenticator, Authy and 2FAS².

Aegis suits Android users who want free, open-source code and control over their backups^1,2. Backups can go to cloud storage you choose, and the vault is locked with a password you hold^3,4. The catch: it runs only on Android, and its pages publish no outside audit, bug bounty or multi-device sync^1,2,6.

Best for: Android users who want an open-source app and control over where backups go.

Where the points come from

Security and trust12 of 37

Backup and recovery28 of 35

Systems2 of 12

Features6 of 12

Price0 of 4

Security and trust 12 of 37 points

Rule	What is published	Points
End-to-end encrypted backup	Not publishedAutomatic backups are copies of the vault, which is encrypted only if you set a password; pages do not say backups are encrypted^2,3,4.	0 / 12
Independent audit, 2023 or later	Not publishedNot published on the project's site or README^1,2.	0 / 10
Open-source apps	YesLicensed under GNU GPL v3.0 on GitHub².	6 / 6
Public bug bounty	Not publishedNot published; the repository's security page shows no security policy and mentions no bounty⁶.	0 / 3
App lock	YesThe vault unlocks with a password or Android biometrics^2,3.	6 / 6

Backup and recovery 28 of 35 points

Rule	What is published	Points
Cloud backup or sync	YesAutomatic backups can go to any cloud provider that supports Android storage access, such as Nextcloud, with no sync built in⁴.	10 / 10
Same codes on several devices	Not publishedNot published on the project's site or README^1,2.	0 / 7
Export all accounts	YesREADME lists export as plaintext or encrypted².	7 / 7
Import from other apps	YesREADME lists 11 authenticator apps to import from, including Google Authenticator, Authy and 2FAS².	6 / 6
Works without an account	YesPrivacy policy says the app collects no data from your device; no sign-up or account is described⁵.	5 / 5

Systems 2 of 12 points

Rule	What is published	Points
Apps	AndroidDistributed on Google Play and F-Droid; the README says Android only^1,2,4.	2 / 12

Features 6 of 12 points

Rule	What is published	Points
Stores passkeys	Not publishedNot published on the project's site or README^1,2.	0 / 3
Sign-in approval prompts	Not publishedNot published on the project's site or README^1,2.	0 / 3
Counter-based (HOTP) codes	YesREADME says it supports HOTP and TOTP².	3 / 3
Folders, tags or search	YesREADME lists grouping entries and searching by name or issuer².	3 / 3

Price 0 of 4 points

Rule	What is published	Points
Cost with backup on two devices	Not publishedFree, but no page documents the same codes on two devices, so the condition is not met^1,2.	0 / 4

The rule behind each line: how we score authenticator apps.

Plans and prices

As the vendor lists them, before tax. Prices are in US dollars unless the plan shows euros; the points use US dollars, with euros converted at the ECB rate.

Plan	Price as listed	Per month	Notes
Free1 person	Free¹	$0	The whole app is free

Strengths

Free, with source code public under GPL-3.0².
Vault master key is wrapped by a key derived from your password with scrypt³.
Handles both time-based and counter-based (HOTP) codes².
Imports from many apps and exports in plaintext or encrypted form^1,2.

Limits

Android only; there is no iOS, desktop or web app^1,2.
No outside audit is published on the project's pages^1,2.
No documented way to use the same codes on two devices at once^1,2.
No push approval prompts or passkey storage are listed^1,2.

Concerns on record

Aegis's own GitHub advisory (Sept 6, 2026, rated High) says a crafted icon pack could overwrite internal files, including the vault, if imported; fixed in 3.4.3⁷.

Other authenticator apps

1
Ente AuthPeople who want encrypted sync, open source and a web view of their codes
91/100
$0cost with backup on two devices
2
Proton AuthenticatorPeople who want encrypted sync and a Windows or Linux app
79/100
$0cost with backup on two devices
3
Zoho OneAuthPeople who want free encrypted backup and the same codes on a phone and a computer
74/100
$0cost with backup on two devices
4
2FAS AuthiPhone and Android users who want a free app without an account
73/100
$0cost with backup on two devices

All 12 authenticator apps

Sources

Aegis Authenticator, Beem Development. Accessed 8 Oct 2026.
beemdevelopment/Aegis, GitHub. Accessed 8 Oct 2026.
Aegis vault format and security design (docs/vault.md), GitHub. Accessed 8 Oct 2026.
Aegis Authenticator on F-Droid, F-Droid. Accessed 8 Oct 2026.
Aegis privacy policy, Beem Development. Accessed 8 Oct 2026.
Aegis security page, GitHub. Accessed 8 Oct 2026.
Arbitrary file overwrite via maliciously crafted icon pack (GHSA-fw8c-jmjv-q6xf), GitHub. Accessed 8 Oct 2026.

Website: getaegis.app · Markdown version · We are not affiliated with Beem Development.