authenticator app · jmh

Stratum

Free, open-source Android code app with password-encrypted backups and no internet permission.

60/100

#5 of 12 authenticator apps
Facts checked 8 Oct 2026

Stratum was called Authenticator Pro before it was republished under a new name after a Google Play policy issue; old backups still restore^5,2.

In short

The app is free and open source under GPL 3.0, for Android only^1,4.
Backups are encrypted with AES-GCM using a key derived from your password with Argon2id³.
It works offline and the vendor says it does not communicate with distant servers¹.
It imports from Google Authenticator, Authy, Steam and Blizzard Authenticator, and exports at any time^1,4.
There is no built-in cloud sync; backups go to a folder you pick, or to a WebDAV server through the third-party DAVx5 app^2,6.

Stratum suits Android users who want an offline, open-source app with strong backup encryption and no sign-up^1,3. It supports TOTP, HOTP, categories and a password or biometric lock^1,4. The catch: it runs only on Android, has no cloud sync of its own, so cloud backup needs DAVx5, and publishes no audit or bug bounty^1,2,4.

Best for: Android users who want an offline, open-source app they fully control.

Where the points come from

Security and trust24 of 37

Backup and recovery28 of 35

Systems2 of 12

Features6 of 12

Price0 of 4

Security and trust 24 of 37 points

Rule	What is published	Points
End-to-end encrypted backup	YesBackups use AES-GCM with a key derived from your password by Argon2id; data is unreadable without it^3,2.	12 / 12
Independent audit, 2023 or later	Not publishedNot published on the vendor's site or repository page^1,4.	0 / 10
Open-source apps	YesSource code is public on GitHub under GPL 3.0^1,4.	6 / 6
Public bug bounty	Not publishedNot published on the vendor's site or repository page^1,4.	0 / 3
App lock	YesVendor says you can set a password and use biometric authentication to protect your codes¹.	6 / 6

Backup and recovery 28 of 35 points

Rule	What is published	Points
Cloud backup or sync	YesAuto Backup writes encrypted files to a WebDAV mount that the third-party DAVx5 app uploads; the app itself has no cloud sync^2,6.	10 / 10
Same codes on several devices	Not publishedNot published for phones or tablets; the Wear OS app needs a connection to your Android device^1,2.	0 / 7
Export all accounts	YesVendor says you can export at any time; the backup file format is documented^1,3.	7 / 7
Import from other apps	YesDocumented imports from Google Authenticator, Authy, Blizzard Authenticator and Steam^4,1.	6 / 6
Works without an account	YesVendor says the app does not communicate with distant servers and needs no Internet access¹.	5 / 5

Systems 2 of 12 points

Rule	What is published	Points
Apps	AndroidDescribed as an app for Android, with a Wear OS app; the FAQ says an iOS version is probably not coming^1,2.	2 / 12

Features 6 of 12 points

Rule	What is published	Points
Stores passkeys	Not publishedNot published on the vendor's site or repository page^1,4.	0 / 3
Sign-in approval prompts	NoThe app needs no Internet access and has no cloud features, so it has no push approval^1,6.	0 / 3
Counter-based (HOTP) codes	YesSupports TOTP, HOTP, mOTP, Steam and Yandex codes^2,4.	3 / 3
Folders, tags or search	YesYou can organise authenticators into categories¹.	3 / 3

Price 0 of 4 points

Rule	What is published	Points
Cost with backup on two devices	Not publishedFree, but no cloud backup or same-code multi-device is documented, so the rule's condition is not met².	0 / 4

The rule behind each line: how we score authenticator apps.

Plans and prices

As the vendor lists them, before tax. Prices are in US dollars unless the plan shows euros; the points use US dollars, with euros converted at the ECB rate.

Plan	Price as listed	Per month	Notes
Free1 person	Free^1,5	$0	Whole app is free

Strengths

Free and open source under GPL 3.0¹.
Backup files are encrypted with a password-derived key, and the FAQ says there is no way around the password^2,3.
Needs no account and works offline¹.
Supports HOTP as well as TOTP, plus categories^1,4.

Limits

Android only; the FAQ says an iOS version is probably not coming².
No built-in cloud sync; the FAQ says it would need the internet permission².
No audit or bug bounty is published on its site or repository page^1,4.
The Wear OS app does not support HOTP, and its data transfer is one-way².

Other authenticator apps

1
Ente AuthPeople who want encrypted sync, open source and a web view of their codes
91/100
$0cost with backup on two devices
2
Proton AuthenticatorPeople who want encrypted sync and a Windows or Linux app
79/100
$0cost with backup on two devices
3
Zoho OneAuthPeople who want free encrypted backup and the same codes on a phone and a computer
74/100
$0cost with backup on two devices
4
2FAS AuthiPhone and Android users who want a free app without an account
73/100
$0cost with backup on two devices

All 12 authenticator apps

Sources

Stratum: open-source two-factor authentication app, Stratum. Accessed 8 Oct 2026.
Stratum F.A.Q., Stratum. Accessed 8 Oct 2026.
Stratum backup format, Stratum. Accessed 8 Oct 2026.
stratumauth/app, GitHub. Accessed 8 Oct 2026.
Download Stratum, Stratum. Accessed 8 Oct 2026.
Back up to WebDAV, Stratum. Accessed 8 Oct 2026.

Website: stratumauth.com · Markdown version · We are not affiliated with jmh.