authenticator app · Twilio

Authy

Free phone app that keeps codes in an encrypted cloud backup and syncs them across devices.

43/100

#10 of 12 authenticator apps
Facts checked 8 Oct 2026

In short

The app is free on iOS; Twilio lists cloud backups and multi-device sync as features^1,3.
Twilio says backups are decrypted only on your devices, with a password only you know¹.
Twilio's backup post describes AES-256 encryption on the phone, with the key derived from your password⁴.
Creating an Authy account requires a phone number⁶.
The download page lists iOS and Android only².

Authy suits people who want encrypted cloud backup and the same codes on several devices, for free^1,3,5. It has an app lock and offline codes¹. The catch: an account needs your phone number, only phone apps are listed, and Twilio reported two security incidents involving Authy in 2022 and 2024^2,6,7,8.

Best for: People who want encrypted cloud backup and multiple devices, and accept giving a phone number.

Where the points come from

Security and trust18 of 37

Backup and recovery17 of 35

Systems4 of 12

Features0 of 12

Price4 of 4

Security and trust 18 of 37 points

Rule	What is published	Points
End-to-end encrypted backup	YesData is decrypted only on devices with a password only you know; AES-256 encryption happens in the phone^1,4.	12 / 12
Independent audit, 2023 or later	Not publishedNot published on the vendor's pages^1,2.	0 / 10
Open-source apps	Not publishedNot published on the vendor's pages^1,2.	0 / 6
Public bug bounty	Not publishedNot published on the vendor's pages^1,2.	0 / 3
App lock	YesThe features page says to use TouchID, PIN protection and passwords to protect access to your tokens¹.	6 / 6

Backup and recovery 17 of 35 points

Rule	What is published	Points
Cloud backup or sync	YesThe features page says to encrypt 2FA data and back it up to Twilio's cloud; the App Store listing agrees^1,3.	10 / 10
Same codes on several devices	YesAdd devices to your account and tokens synchronise; Twilio's multi-device post sets no device limit^3,5.	7 / 7
Export all accounts	Not publishedNot published on the vendor's features page¹.	0 / 7
Import from other apps	Not publishedNot published on the vendor's features page¹.	0 / 6
Works without an account	NoTwilio's privacy notice says an Authy account requires a phone number⁶.	0 / 5

Systems 4 of 12 points

Rule	What is published	Points
Apps	iOS, AndroidThe download page lists only Mobile: Google Play and the Apple App Store².	4 / 12

Features 0 of 12 points

Rule	What is published	Points
Stores passkeys	Not publishedNot published on the vendor's pages^1,2.	0 / 3
Sign-in approval prompts	Not publishedNot published on the vendor's features page¹: device approval is described only for adding devices.	0 / 3
Counter-based (HOTP) codes	Not publishedNot published on the vendor's features page¹.	0 / 3
Folders, tags or search	Not publishedNot published on the vendor's features page¹: it mentions editing accounts only.	0 / 3

Price 4 of 4 points

Rule	What is published	Points
Cost with backup on two devices	$0Free app that includes cloud backup and multi-device sync^1,3.	4 / 4

The rule behind each line: how we score authenticator apps.

Plans and prices

As the vendor lists them, before tax. Prices are in US dollars unless the plan shows euros; the points use US dollars, with euros converted at the ECB rate.

Plan	Price as listed	Per month	Notes
Free1 person	Free^1,3	$0	Cloud backup and multi-device included

Strengths

Free app with cloud backup and multi-device sync^1,3.
Twilio says backups are encrypted on your device with a password it never receives^1,4.
TouchID, PIN or password protects access to your tokens¹.
Codes are generated on the device and work offline¹.

Limits

Creating an account requires a phone number, and Twilio also collects an email address⁶.
The download page lists mobile apps only, with no desktop app².
A forgotten backup password cannot be recovered by Twilio¹.
Twilio reported an unauthenticated endpoint exposing Authy account data, including phone numbers, in July 2024⁷.

Concerns on record

Twilio reported on July 1, 2024 that threat actors used an unauthenticated endpoint to identify data tied to Authy accounts, including phone numbers⁷.
Twilio reported in August 2022 that attackers accessed 93 Authy users' accounts and registered extra devices; Twilio removed them⁸.

What Twilio says

Vendor claims. We show them, but they earn no points.

Twilio says it never receives the backup password and cannot recover it¹.

Other authenticator apps

1
Ente AuthPeople who want encrypted sync, open source and a web view of their codes
91/100
$0cost with backup on two devices
2
Proton AuthenticatorPeople who want encrypted sync and a Windows or Linux app
79/100
$0cost with backup on two devices
3
Zoho OneAuthPeople who want free encrypted backup and the same codes on a phone and a computer
74/100
$0cost with backup on two devices
4
2FAS AuthiPhone and Android users who want a free app without an account
73/100
$0cost with backup on two devices

All 12 authenticator apps

Sources

Authy features, Authy. Accessed 8 Oct 2026.
Download Authy, Authy. Accessed 8 Oct 2026.
Twilio Authy on the App Store, Apple App Store. Accessed 8 Oct 2026.
How Authy 2FA Backups Work, Twilio. Accessed 8 Oct 2026.
New Phone? Lost Phone? Our Multi-Device Feature Keeps You 2FA-Ready!, Twilio. Accessed 8 Oct 2026.
Twilio privacy notice, Twilio. Accessed 8 Oct 2026.
Security alert: Authy app (Android and iOS), Twilio. Accessed 8 Oct 2026.
Twilio incident update, August 2022, Twilio. Accessed 8 Oct 2026.

Website: authy.com · Markdown version · We are not affiliated with Twilio.