--- title: Authy canonical: https://saasranked.com/software/twilio-authy/ category: Authenticator Apps points: 43 rank: 10 of 12 facts_checked: 2026-10-08 --- # Authy Free phone app that keeps codes in an encrypted cloud backup and syncs them across devices. 43 points out of 100. #10 of 12 authenticator apps. Vendor: Twilio. Website: https://authy.com/ - The app is free on iOS; Twilio lists cloud backups and multi-device sync as features [1][3]. - Twilio says backups are decrypted only on your devices, with a password only you know [1]. - Twilio's backup post describes AES-256 encryption on the phone, with the key derived from your password [4]. - Creating an Authy account requires a phone number [6]. - The download page lists iOS and Android only [2]. Verdict: Authy suits people who want encrypted cloud backup and the same codes on several devices, for free [1][3][5]. It has an app lock and offline codes [1]. The catch: an account needs your phone number, only phone apps are listed, and Twilio reported two security incidents involving Authy in 2022 and 2024 [2][6][7][8]. Best for: People who want encrypted cloud backup and multiple devices, and accept giving a phone number. ## Points | Criterion | Line | Value | Points | Note | |---|---|---|---|---| | Security and trust | End-to-end encrypted backup | Yes | 12/12 | Data is decrypted only on devices with a password only you know; AES-256 encryption happens in the phone [1][4]. | | Security and trust | Independent audit, 2023 or later | Not published | 0/10 | Not published on the vendor's pages [1][2]. | | Security and trust | Open-source apps | Not published | 0/6 | Not published on the vendor's pages [1][2]. | | Security and trust | Public bug bounty | Not published | 0/3 | Not published on the vendor's pages [1][2]. | | Security and trust | App lock | Yes | 6/6 | The features page says to use TouchID, PIN protection and passwords to protect access to your tokens [1]. | | Backup and recovery | Cloud backup or sync | Yes | 10/10 | The features page says to encrypt 2FA data and back it up to Twilio's cloud; the App Store listing agrees [1][3]. | | Backup and recovery | Same codes on several devices | Yes | 7/7 | Add devices to your account and tokens synchronise; Twilio's multi-device post sets no device limit [3][5]. | | Backup and recovery | Export all accounts | Not published | 0/7 | Not published on the vendor's features page [1]. | | Backup and recovery | Import from other apps | Not published | 0/6 | Not published on the vendor's features page [1]. | | Backup and recovery | Works without an account | No | 0/5 | Twilio's privacy notice says an Authy account requires a phone number [6]. | | Systems | Apps | iOS, Android | 4/12 | The download page lists only Mobile: Google Play and the Apple App Store [2]. | | Features | Stores passkeys | Not published | 0/3 | Not published on the vendor's pages [1][2]. | | Features | Sign-in approval prompts | Not published | 0/3 | Not published on the vendor's features page [1]: device approval is described only for adding devices. | | Features | Counter-based (HOTP) codes | Not published | 0/3 | Not published on the vendor's features page [1]. | | Features | Folders, tags or search | Not published | 0/3 | Not published on the vendor's features page [1]: it mentions editing accounts only. | | Price | Cost with backup on two devices | $0 | 4/4 | Free app that includes cloud backup and multi-device sync [1][3]. | ## Plans | Plan | Price | Per month (USD) | |---|---|---| | Free | Free [1][3] | $0 | ## Strengths - Free app with cloud backup and multi-device sync [1][3]. - Twilio says backups are encrypted on your device with a password it never receives [1][4]. - TouchID, PIN or password protects access to your tokens [1]. - Codes are generated on the device and work offline [1]. ## Limits - Creating an account requires a phone number, and Twilio also collects an email address [6]. - The download page lists mobile apps only, with no desktop app [2]. - A forgotten backup password cannot be recovered by Twilio [1]. - Twilio reported an unauthenticated endpoint exposing Authy account data, including phone numbers, in July 2024 [7]. ## Vendor claims (not scored) - Twilio says it never receives the backup password and cannot recover it [1]. ## Concerns - Twilio reported on July 1, 2024 that threat actors used an unauthenticated endpoint to identify data tied to Authy accounts, including phone numbers [7]. - Twilio reported in August 2022 that attackers accessed 93 Authy users' accounts and registered extra devices; Twilio removed them [8]. ## Sources 1. [Authy features](https://authy.com/features/), Authy, accessed 2026-10-08 2. [Download Authy](https://authy.com/download/), Authy, accessed 2026-10-08 3. [Twilio Authy on the App Store](https://apps.apple.com/us/app/twilio-authy/id494168017), Apple App Store, accessed 2026-10-08 4. [How Authy 2FA Backups Work](https://www.twilio.com/en-us/blog/how-the-authy-two-factor-backups-work), Twilio, accessed 2026-10-08 5. [New Phone? Lost Phone? Our Multi-Device Feature Keeps You 2FA-Ready!](https://www.twilio.com/en-us/blog/developers/best-practices/multi-device), Twilio, accessed 2026-10-08 6. [Twilio privacy notice](https://www.twilio.com/en-us/legal/privacy), Twilio, accessed 2026-10-08 7. [Security alert: Authy app (Android and iOS)](https://www.twilio.com/en-us/changelog/Security_Alert_Authy_App_Android_iOS), Twilio, accessed 2026-10-08 8. [Twilio incident update, August 2022](https://www.twilio.com/en-us/blog/august-2022-social-engineering-attack), Twilio, accessed 2026-10-08