In this articleShow
Short answer: Any authenticator app is far safer than SMS codes. The real difference between them is what happens when you lose your phone. For most people, 2FAS (iPhone and Android) or Aegis (Android) with an encrypted backup you control is the best balance of security and privacy. Google Authenticator is fine if you're comfortable relying on your Google account for backup. We'd no longer recommend Authy for new users: its desktop apps were shut down in 2024, and a 2024 incident exposed users' phone numbers. And wherever a site offers passkeys, use them instead of codes altogether.
Comparison
App | Platforms | Backup / sync | Open source | Watch out for |
|---|---|---|---|---|
2FAS | iOS, Android | Optional encrypted backup (iCloud/Google Drive) | Yes | You must turn backup on |
Aegis | Android | Encrypted local vault and exports you control | Yes | Android only; backups are your job |
Ente Auth | iOS, Android, desktop, web | End-to-end encrypted sync | Yes | Newer, smaller company |
Google Authenticator | iOS, Android | Sync via your Google account | No | Researchers criticized the sync for lacking end-to-end encryption when it launched in 2023 |
Microsoft Authenticator | iOS, Android | Cloud backup via Microsoft account | No | Best for Microsoft work accounts |
Authy | iOS, Android | Encrypted cloud backup | No | Desktop apps discontinued in 2024; phone-number-based account; 2024 phone-number exposure |
What happened with Authy
In 2024, Twilio discontinued Authy's desktop apps (Windows, macOS, Linux) and logged desktop users out, and some users who hadn't synced to a phone lost access to their codes. Separately, in July 2024 attackers abused an unauthenticated Authy endpoint to collect data including users' phone numbers (a group claimed 33 million). Twilio said accounts weren't compromised, but exposed numbers increase the risk of targeted phishing and SIM-swap attempts. Authy still works on mobile, but there are better choices for new setups.
The backup decision matters most
If you want… | Choose |
|---|---|
Automatic recovery with minimal effort | Ente Auth, or Google/Microsoft Authenticator with cloud backup |
Maximum control and privacy | Aegis or 2FAS with an encrypted backup file stored safely (for example in your password manager) |
Everything in one app | A password manager with built-in codes (1Password, Bitwarden Premium) — convenient, but it puts passwords and second factors in one place |
Always save the recovery codes websites give you when you turn on two-factor authentication, and store them somewhere other than your phone.
Why SMS codes aren't enough
SMS is better than nothing, but SIM-swap attacks let criminals move your number to their phone and receive your codes. Use an authenticator app — or better, passkeys — for email, banking and your password manager.
Passkeys are the next step
Passkeys replace both the password and the code with a cryptographic key on your device, and they can't be phished. Many major services (Google, Microsoft, Apple, Amazon, PayPal) support them. Keep an authenticator app for sites that don't.
How to switch authenticator apps safely
- Install the new app and set up its backup first.
- For each account, sign in, remove the old 2FA method and add the new app — or use the new app's import tool if it supports exports from your old app.
- Test a code from the new app before deleting the old entry.
- Save fresh recovery codes for each account.
- Only delete the old app when every account works.
Frequently asked questions
What is the most secure authenticator app?
Open-source apps with encrypted backups you control — Aegis on Android or 2FAS on iPhone and Android — offer the strongest privacy. Passkeys are more secure than any code-based app.
Is Google Authenticator safe?
Yes for most people. Its cloud sync ties your codes to your Google account, so secure that account with a strong password and passkey.
What happens if I lose my phone with my authenticator app?
You'll need your app's backup or each site's recovery codes. That's why setting up backup on day one matters most.
Is Authy still safe to use?
Authy still works on mobile, but its desktop apps were discontinued in 2024 and a 2024 incident exposed users' phone numbers. We recommend other apps for new users.
Sources
- BleepingComputer, Twilio kills off Authy for desktop, forcibly logs out all users
- Dark Reading, Twilio users kicked out of desktop app
- MacTrast, Authy 2FA service hacked, 33 million phone numbers exposed
- BleepingComputer, Google will add end-to-end encryption to Google Authenticator (2023 sync criticism)
