The best TOTP authenticator apps in 2026

Every account with two-factor authentication eventually asks the same question: where do the codes live? The app you choose holds the secrets guarding your email, your bank, and your exchange accounts.

The landscape has shifted in the past three years. Cloud sync went from rare to expected, Authy retired its desktop apps in 2024, open-source projects like 2FAS, Aegis, and Ente Auth matured into daily drivers, and browser-based generators became a real category. Every app here runs the same math, the TOTP algorithm from RFC 6238 covered in what TOTP is and how those codes work. What separates them is storage, sync, exit, and trust.

What makes a good authenticator app

A short checklist settles most of it:

• Offline generation. TOTP is pure computation; codes should appear with the network off.
• Export and backup. If an app gives you no way out, the vendor owns your accounts.
• Multi-device support. Codes on one fragile phone are a single point of failure.
• No account lock-in. Apps that work, and recover, without registration respect you more.
• Open source. Not a guarantee, but source you can read beats source you cannot.
• No ads or trackers. An authenticator that phones home leaks when and where you log in.

No app below scores well on all of these. That tradeoff is the decision.

Google Authenticator

Google's app is the one millions already have, and better than its old reputation. Since April 2023 it syncs codes to your Google Account, so a new phone restores everything after sign-in. It is free, ad-free, and supports batch export through QR codes under "Transfer accounts."

Two caveats. Sync is not end-to-end encrypted: Google promised it shortly after launch, and three years later it still has not shipped, so your codes are protected by your Google account rather than a key only you hold. Whoever takes over that account takes the codes. And it is phone-only, with no desktop, web, or browser client. As a simple free default it is fine, and the QR export makes leaving easy.

Microsoft Authenticator

The strongest case for Microsoft Authenticator is the Microsoft ecosystem. For Microsoft accounts it does push approvals with number matching, now the default, plus fully passwordless sign-in. As a TOTP authenticator, Microsoft's app handles any other service the standard way: scan the QR code, get six digits.

Portability is the weak spot. Backups are platform-bound, iCloud on iOS and a personal Microsoft account on Android, and a backup made on one platform cannot be restored on the other. There is no export of secret keys, so leaving means re-enrolling every account by hand.

Authy

Authy's multi-device sync was years ahead of everyone else's, and the core product still works well: free, reliable, on iOS, Android, and as a browser extension, with encrypted backups tied to your phone number and a PIN.

The desktop apps reached end of life on March 19, 2024 and stopped working that August, and since Authy has no export, the shutdown doubled as a forced-migration drill many users could only pass by re-enrolling everything. In June 2024, Twilio confirmed attackers identified the phone numbers of roughly 33 million Authy users through an unsecured API; code seeds were not leaked, but the numbers fed a wave of targeted phishing. Closed source, no export, one retired platform: that combination asks for a lot of trust.

2FAS

2FAS is what a well-run free TOTP app looks like: open-source clients, no account required, iOS and Android, no ads. Backups go to your own cloud, Google Drive on Android or iCloud on iOS, and a local backup file can move between platforms, so switching from Android to iPhone means no re-enrolling. Importers exist for other apps, including Google Authenticator, and a browser extension pairs with the phone for desktop approvals. The main gap is the lack of a desktop or web app independent of the phone.

Aegis

Aegis is Android-only and makes no apology for it. It is free, open source, on both Play Store and F-Droid, and the power-user pick on that platform for a reason: the vault is encrypted on disk and locked with a password or biometric, backups are automatic to a location you choose, and the export format is an encrypted vault file you control entirely.

There is no Aegis cloud at all: backups go where you put them, the best or the most demanding design here depending on how you feel about managing files. On Android it is the benchmark; no iOS version is the entire downside.

Ente Auth

Ente Auth, from the company behind the encrypted photo service, is the most complete free package on paper: Android, iOS, Windows, macOS, Linux, and web, with end-to-end encrypted sync across all of them, open-source clients and server, and both export and import for moving data in and out.

Set it up once and the same codes are on your phone, your laptop, and a browser you trust. The tradeoffs: no platform feels as polished as a single-platform specialist, and the project is younger than the incumbents. Free, open source, cross-platform, and encrypted is a combination almost nobody else offers.

A browser-based option: 2FA by DependsiT

This is our product, so weigh it accordingly and check every claim against the table below.

2FA by DependsiT is a web-based 2FA tool. The homepage hosts a guest generator: paste a Base32 secret, an otpauth:// URI, a QR image, or an entire Google Authenticator export, and codes appear instantly. All computation happens in your browser, with zero requests to any server and nothing stored, which makes it a TOTP authenticator online that needs no install, and a quick 2FA authenticator online when you are on a locked-down work machine. The usual caution applies to any tool, ours included: do not paste secrets on a shared computer.

For storage, the vault is zero-knowledge: secrets are encrypted client-side before upload, using PBKDF2 salted key derivation, HKDF key separation, and AES-256-GCM, while the server stores ciphertext only and login uses Argon2id password hashes. TOTP, HOTP, and Steam Guard are supported, with per-key settings for algorithm (SHA1, SHA256, SHA512), digits (6, 7, or 8), period, and counter. The site installs as a PWA and then works fully offline. The free tier covers 100 folders and 100 entries; paid plans are $24 per year or $99 for lifetime.

It is one option among several. The case for a browser tool is that it runs anywhere, stores nothing by default, and costs nothing to try: the guest generator needs no account, and the features page details the vault.

The field at a glance

App	Platforms	Sync	Export	Open source	Cost
Google Authenticator	iOS, Android	Google Account (no E2EE)	QR batch export	No	Free
Microsoft Authenticator	iOS, Android	iCloud or Microsoft account	None	No	Free
Authy	iOS, Android	Authy account	None	No	Free
2FAS	iOS, Android	Google Drive or iCloud	Backup file	Yes	Free
Aegis	Android	None; you manage backups	Encrypted vault file	Yes	Free
Ente Auth	iOS, Android, Windows, macOS, Linux, web	End-to-end encrypted	File export	Yes	Free
2FA by DependsiT	Any browser; installable PWA	Optional zero-knowledge vault	Accepts Google Authenticator exports	No	Free tier; $24/year; $99 lifetime

One honest note on the last row: ours is not open source; its trust rests on the generator making zero network requests, verifiable in your browser's developer tools, and the vault server receiving only ciphertext.

How to choose

By platform, the short version:

• iPhone: Google Authenticator for zero decisions, 2FAS for backups and easy import, Ente Auth for desktop and web too. Aegis is not an option.
• Android: Aegis for control, 2FAS for polish, Ente Auth for sync everywhere.
• Desktop or no-phone moments: Ente Auth's desktop apps, or a browser generator like ours that installs as a PWA.
• All-in on Microsoft: Microsoft Authenticator, for the push approvals alone.

By trust, the question is who you believe. Google and Microsoft are closed source but enormous and accountable to regulators; 2FAS, Aegis, and Ente publish their code but are smaller. Neither is automatically safe. Raivo OTP was a well-loved open-source iOS app until it was sold in 2023 and a botched 2024 update locked users out of their tokens. Ownership changes after you commit, so whatever you pick, exercise the export button early.

Moving your accounts between apps

If your current app is Google Authenticator, you are in luck: "Transfer accounts" produces a batch of QR codes you can scan into 2FAS, Aegis, or Ente Auth. Our guest generator also accepts the whole export file for a readable copy while you decide.

If your current app has no export, as with Authy or Microsoft, you re-enroll account by account: disable 2FA on the site, re-enable it, scan the new QR into the new app, confirm a code works, then delete the old entry. Before you reset the old phone, test the restore path on the new one. An untested backup is a hypothesis, not a backup.

Frequently asked questions

Which TOTP app is best for iPhone?

The best TOTP app for iOS, for most people, is 2FAS or Ente Auth: free TOTP apps with iOS clients, cloud backup, and import tools, and Ente adds desktop and web. Google Authenticator is simplest if you accept its sync model, Aegis has no iOS version, and our generator runs in Safari as an offline-capable PWA.

Is Google Authenticator still good?

Yes, for what it is: free, synced, batch QR export, no ads. The lasting complaints are sync without end-to-end encryption and no desktop or web client. If neither bothers you it remains reasonable; if either does, 2FAS and Ente import from it directly.

Can I use two authenticator apps at once?

Yes. A TOTP secret is just a string, and nothing ties it to one app. Scan the same enrollment QR into both, or export from one and import into the other, and both generate identical codes. A second copy on a backup device is a reasonable hedge, as long as you treat both with the same care.

Are free TOTP apps safe?

The algorithm is standardized, so price tells you nothing about code quality; every app in the table except ours is entirely free, and ours is free at the point of use. Safety comes from how an app stores secrets, whether it lets you export them, and whether it respects your attention.

What happens if I lose my phone?

It depends on what you set up beforehand. Synced apps like Google Authenticator, 2FAS, and Ente Auth restore codes after you sign in on the new device. Aegis restores from your backup file, and Microsoft Authenticator restores only onto the same platform. With no backup, recovery codes are the only path, and after that it is per-site support. If the phrase in your head right now is "I lost my authenticator," save those codes on the next enrollment screen you see.

The best authenticator app is the one you can still open when your phone is at the bottom of a lake. Pick one from the table, export your secrets today, and test the restore while it is still boring.