--- title: Stratum canonical: https://saasranked.com/software/stratum/ category: Authenticator Apps points: 60 rank: 5 of 12 facts_checked: 2026-10-08 --- # Stratum Free, open-source Android code app with password-encrypted backups and no internet permission. 60 points out of 100. #5 of 12 authenticator apps. Vendor: jmh. Website: https://stratumauth.com/ - The app is free and open source under GPL 3.0, for Android only [1][4]. - Backups are encrypted with AES-GCM using a key derived from your password with Argon2id [3]. - It works offline and the vendor says it does not communicate with distant servers [1]. - It imports from Google Authenticator, Authy, Steam and Blizzard Authenticator, and exports at any time [1][4]. - There is no built-in cloud sync; backups go to a folder you pick, or to a WebDAV server through the third-party DAVx5 app [2][6]. Verdict: Stratum suits Android users who want an offline, open-source app with strong backup encryption and no sign-up [1][3]. It supports TOTP, HOTP, categories and a password or biometric lock [1][4]. The catch: it runs only on Android, has no cloud sync of its own, so cloud backup needs DAVx5, and publishes no audit or bug bounty [1][2][4]. Best for: Android users who want an offline, open-source app they fully control. Status: Stratum was called Authenticator Pro before it was republished under a new name after a Google Play policy issue; old backups still restore [5][2]. ## Points | Criterion | Line | Value | Points | Note | |---|---|---|---|---| | Security and trust | End-to-end encrypted backup | Yes | 12/12 | Backups use AES-GCM with a key derived from your password by Argon2id; data is unreadable without it [3][2]. | | Security and trust | Independent audit, 2023 or later | Not published | 0/10 | Not published on the vendor's site or repository page [1][4]. | | Security and trust | Open-source apps | Yes | 6/6 | Source code is public on GitHub under GPL 3.0 [1][4]. | | Security and trust | Public bug bounty | Not published | 0/3 | Not published on the vendor's site or repository page [1][4]. | | Security and trust | App lock | Yes | 6/6 | Vendor says you can set a password and use biometric authentication to protect your codes [1]. | | Backup and recovery | Cloud backup or sync | Yes | 10/10 | Auto Backup writes encrypted files to a WebDAV mount that the third-party DAVx5 app uploads; the app itself has no cloud sync [2][6]. | | Backup and recovery | Same codes on several devices | Not published | 0/7 | Not published for phones or tablets; the Wear OS app needs a connection to your Android device [1][2]. | | Backup and recovery | Export all accounts | Yes | 7/7 | Vendor says you can export at any time; the backup file format is documented [1][3]. | | Backup and recovery | Import from other apps | Yes | 6/6 | Documented imports from Google Authenticator, Authy, Blizzard Authenticator and Steam [4][1]. | | Backup and recovery | Works without an account | Yes | 5/5 | Vendor says the app does not communicate with distant servers and needs no Internet access [1]. | | Systems | Apps | Android | 2/12 | Described as an app for Android, with a Wear OS app; the FAQ says an iOS version is probably not coming [1][2]. | | Features | Stores passkeys | Not published | 0/3 | Not published on the vendor's site or repository page [1][4]. | | Features | Sign-in approval prompts | No | 0/3 | The app needs no Internet access and has no cloud features, so it has no push approval [1][6]. | | Features | Counter-based (HOTP) codes | Yes | 3/3 | Supports TOTP, HOTP, mOTP, Steam and Yandex codes [2][4]. | | Features | Folders, tags or search | Yes | 3/3 | You can organise authenticators into categories [1]. | | Price | Cost with backup on two devices | Not published | 0/4 | Free, but no cloud backup or same-code multi-device is documented, so the rule's condition is not met [2]. | ## Plans | Plan | Price | Per month (USD) | |---|---|---| | Free | Free [1][5] | $0 | ## Strengths - Free and open source under GPL 3.0 [1]. - Backup files are encrypted with a password-derived key, and the FAQ says there is no way around the password [2][3]. - Needs no account and works offline [1]. - Supports HOTP as well as TOTP, plus categories [1][4]. ## Limits - Android only; the FAQ says an iOS version is probably not coming [2]. - No built-in cloud sync; the FAQ says it would need the internet permission [2]. - No audit or bug bounty is published on its site or repository page [1][4]. - The Wear OS app does not support HOTP, and its data transfer is one-way [2]. ## Sources 1. [Stratum: open-source two-factor authentication app](https://stratumauth.com/), Stratum, accessed 2026-10-08 2. [Stratum F.A.Q.](https://stratumauth.com/wiki/faq), Stratum, accessed 2026-10-08 3. [Stratum backup format](https://stratumauth.com/wiki/backup-format), Stratum, accessed 2026-10-08 4. [stratumauth/app](https://github.com/stratumauth/app), GitHub, accessed 2026-10-08 5. [Download Stratum](https://stratumauth.com/download), Stratum, accessed 2026-10-08 6. [Back up to WebDAV](https://stratumauth.com/wiki/webdav-backup), Stratum, accessed 2026-10-08