Authy in 2026: what changed, and whether you should stay or leave

For roughly a decade, "just use Authy" was the default answer to "which authenticator app should I get?" It synced across devices when rivals would not back up at all, encrypted those backups before anyone else bothered, and was named in half the setup docs you have ever seen. Then 2024 happened: three changes in six months, each defensible from a vendor's spreadsheet, each worse for the person holding the phone.

Here is the fair version: Authy is not unsafe; its cryptography did not break, and nothing in 2024 exposed a single seed. The app became locked — one device, no desktop, no export, your phone number as the entire identity — and "safe" and "locked" are different questions when you are the one inside the room. For the app-by-app view, see our 2026 TOTP comparison. This post is just Authy: what changed, and how to leave cleanly if it comes to that.

What Authy is

Authy is a TOTP authenticator owned by Twilio, acquired in 2017 — a forward-looking purchase for a phone-number-API company. The pitch was what nobody else had: codes on every device — phone, tablet, desktop, browser extension — with encrypted cloud backups in between, protected by a password you chose, not an account you registered. No email, no username: install, type your number, get a code, and the number becomes the account. Free, closed source, iOS and Android — and for years the recommended app in many services' setup docs. The product lives at authy.com.

2024, in order

March: one device. Twilio discontinued multi-device support — one active device per account — and announced the end of the Authy desktop apps, final day March 19, 2024 (help.twilio.com); the apps stopped working entirely that August. The browser extension went the same way later, on a quieter schedule. After a decade of "your codes everywhere," the summary of the Authy app in 2026 is: your codes on one phone.

June: 33 million phone numbers. Twilio disclosed that an unsecured API endpoint had let a threat actor enumerate phone numbers tied to Authy accounts — about 33 million of them (twilio.com). No secrets were involved — numbers only. But a list of 33 million numbers that maps each to "this person uses Authy" is a targeting list, and within weeks it was circulating on hacking forums. The desktop shutdown also removed the escape hatch — the one place a determined user could get at their own secrets. More below.

The phone number is the account

There is no Authy email, username, or password. The number is the account: type it, get a code by SMS or voice call, and you are in. The encrypted backups add a second gate — a backups password that never reaches Twilio's servers — so your number alone does not let an attacker restore your seeds. But the number is the identifier, and identifiers that double as carrier-controlled assets have a known failure mode: SIM swaps, covered in our guide to how 2FA gets bypassed. The 2024 leak made that design more expensive: before it, SIM-swapping an Authy user required guessing who had the app; after it, the guesswork was a download. A public list of Authy users' numbers plus routine carrier port-out procedures is a worksheet, and the worksheet got worked.

The export problem

Authy has no official export. Not to a file, not to a batch of QR codes, not to anything: secrets live in encrypted backups that restore only inside Authy itself. If you decide to leave, the intended experience is that you cannot.

Community workarounds exist, and pretending otherwise would be dishonest. The best-known leaned on the pre-EOL desktop app, whose local database could be opened and the secrets read out; unofficial tools also decrypt your own backup with your own backups password and dump the seeds. But they are unsupported by definition — old builds, undocumented formats, details that change without notice — and a tool that silently extracts 39 of 40 seeds is worse than no tool, because you will trust the list. The clean path is slower and boring: visit each service, turn 2FA off and back on, scan the fresh QR into the new app, and let the service rotate the secret. Rotation is the point — the old secret keeps generating valid codes from wherever it exists until the service replaces it.

What Authy still does well

Fairness requires the other column. The TOTP engine is solid: the same standard math as everyone else, done reliably, with the algorithm and digit variations some services need. The encrypted backups are real encryption — the backups password derives the key, and Twilio never receives it. The interface is among the most approachable in the category: big targets, clear labels, nothing to configure. The honest framing is not "Authy is unsafe" but "a well-built app inside a locked room" — and 2024 removed two of the three doors while publishing the address of the third.

Stay or leave

Stay if the 2024 changes did not touch how you use the app: mobile-only from the start, a long backups password, a short entry list, no philosophical trouble with closed source. The failure mode of staying is quiet — discovering, on the day you want to leave, that leaving was scheduled for some earlier day you never got around to. Leave if you want codes somewhere other than the one phone, want an exit that does not depend on reverse engineering, or dislike a phone number as identity after 33 million of those numbers went walking. Leaving costs one boring afternoon per few dozen accounts; staying costs nothing today.

How to leave safely

The migration is manual by design, but doing it in order prevents the classic disaster: deleting Authy before the new app is proven.

1. Inventory. Open Authy and write down every service it holds — this list is the project plan.
2. Save recovery codes first. Download each service's one-time recovery codes before touching anything else — the escape hatch for the whole operation.
3. Re-enroll, one service at a time. Log in, disable 2FA, re-enable it, scan the new QR into the new app, and confirm a code works before moving on — skipping the confirmation is how people discover a bad scan three weeks later.
4. Keep Authy installed until the last entry is verified. The old install is the safety net; deleting it early turns a mistake into a lockout.
5. Delete the account, not just the app. When everything is re-enrolled and verified, remove the Authy account from within the app, then uninstall — that clears the number-to-account mapping on Twilio's side.

One failure to expect: a freshly enrolled code getting rejected. It is almost never the migration's fault — it is phone clock drift, and our guide to 2FA codes not working has the ten-second fix.

Where to go instead

Three names cover most of the demand; the fuller field is in our Google Authenticator alternatives piece. 2FAS is the straightforward pick: open source, iOS and Android, no account, backups to your own cloud. Ente Auth is the sync-everywhere pick: end-to-end encrypted across phone, desktop, and web. Aegis is the Android power-user pick: an encrypted local vault with backups you manage yourself. And if the desire is "codes on the machine I am logging in from," the browser-based options in TOTP in the browser are a real category now, with the usual shared-computer caveats.

Whichever you pick, exercise the exit on day one: export, restore onto a second device, confirm the codes match. An untested exit is a hypothesis.

A tooling note for the re-enrollment grind — you are about to meet forty QR codes: the guest generator takes a QR image, an otpauth:// link, or the raw secret and shows the live code immediately, computed entirely in the browser — nothing sent, nothing stored — turning "does this secret work" into a ten-second check instead of a phone juggle. When you want the re-issued secrets kept somewhere with a front door you control, create a free account for the vault: secrets are encrypted in your browser before upload — PBKDF2, HKDF, AES-256-GCM — and the server holds ciphertext it cannot read.

None of this says flee Authy tonight. The cost of leaving is knowable, finite, mostly boredom — and lowest before you need the exit. Keep the recovery codes dry and test the backup while it is boring. The 2024 lesson was not "Authy bad"; it was "the export button is a load-bearing feature."

Frequently asked questions

Is Authy safe in 2026?

Its cryptography is sound, and the 2024 incident leaked phone numbers, not secrets — no seeds, backups, or backup passwords are known to have been exposed. The real risks are architectural: one device, no export, and a phone number as the account identity — what SIM swaps target. If you stay, a long backups password matters most.

Can I export my tokens from Authy?

Not officially. Authy offers no export of any kind; secrets restore only inside Authy itself. Unofficial workarounds exist, built on the discontinued desktop app or third-party decryptors, but they are unsupported and can fail silently. The reliable path is manual re-enrollment: turn 2FA off and on at each service and scan the fresh QR into the new app.

What exactly was leaked in the 2024 Authy incident?

Phone numbers — roughly 33 million, harvested through an unsecured API endpoint. Nothing else: no seeds, no backups, no passwords. The damage was privacy and targeting — the list told attackers who uses Authy, which made the follow-up phishing and SIM swaps considerably better aimed.

Can I use Authy on multiple devices now?

No. Multi-device support was discontinued in March 2024, and each account supports one active device — a phone, since the desktop apps stopped working in August 2024 and the browser extension was retired as well. Adding a new device means deactivating the old one, so plan migrations before switching phones, not after.

What is the best alternative to Authy?

For most people, 2FAS on iOS or Android: open source, free, backups to your own cloud, real import tools. Ente Auth if you want the same codes on desktop and web with end-to-end encryption, Aegis if you are Android-only and want local control, and a browser-based generator if your priority is codes on the machine you log in from. All of them can be tested in an afternoon.