Free two-factor authentication apps in 2026

Recovery determines the safest choice

A 2FA app prevents a stolen password from being enough on its own. Its recovery path matters as much as its code screen: encrypted backups, device support, and exports determine what happens when a phone is lost. Aegis keeps an encrypted local vault on Android, Ente Auth syncs encrypted codes across mobile, desktop, and web apps, and 2FAS covers Android and iOS with optional platform-cloud backup. Bitwarden’s built-in generator keeps codes beside passwords, which is convenient but concentrates both factors in one account.

For team use, document who can recover access when a device is lost and who owns the service’s backup codes. Interface preferences come after that recovery plan.

A backup matters more than the authenticator brand

Losing a phone can also mean losing every code stored only on that device. Recovery then depends on each service’s backup codes or account-recovery process, and some accounts may not be recoverable. Modern Google Authenticator versions can sync codes through a Google Account, but local-only use is still available. Whatever app you choose, verify its backup before depending on it.

Useful features include an encrypted local vault, an encrypted backup that you control, and source code that can be inspected. No single feature replaces saved recovery codes from the accounts themselves.

The first factor is the password itself, and the free password managers guide compares where to keep a unique one for every account. A free VPN covers a different risk, traffic on public Wi-Fi.

What matters before you migrate codes

The first question is backup. A 2FA app with no recovery path can be secure and still be a bad daily choice, because a lost phone can turn every protected login into a support ticket. Aegis provides encrypted backup exports you store yourself. Ente Auth offers end-to-end encrypted account sync plus encrypted local backups and exports. 2FAS offers optional encrypted cloud backup. The right model depends on whether you trust your own backup habits more than a provider-managed sync path.

The second question is device coverage. Aegis is Android-only. Ente Auth has Android, iOS, desktop, and web apps, while 2FAS combines Android and iOS apps with a paired browser extension. Authy remains available on mobile, but new users should weigh its closed-source model, phone-number dependency, lack of export, and discontinued desktop apps.

The third question is separation from your password manager. Keeping passwords and TOTP codes together in Bitwarden is convenient and can be reasonable for many personal accounts, but it weakens the second-factor model if the vault is compromised. For primary email, banking, password managers, and work admin accounts, a separate authenticator app or hardware key is the more conservative setup.

Before migrating, save backup codes from every important service and confirm you can log in after moving one account. Do not delete the old authenticator app until you have checked the accounts that matter most.

Five authenticator models and their recovery options

1. Aegis Authenticator: encrypted local vaults on Android

Aegis keeps codes in an encrypted vault on the Android phone and does not sync them to any account.

Aegis documents TOTP and HOTP generation, an AES-256-GCM encrypted vault, password or biometric unlock, encrypted exports, automatic backups to a location you choose, and imports from supported app formats. Some direct app-data imports require a rooted Android device, so do not assume an Authy transfer will work.

The limits are platform and convenience. Aegis is Android-only, has no desktop app, and does not silently cloud-sync your codes. You export an encrypted backup file and store it somewhere safe, which is a little more manual than account-based sync but gives you more control over recovery.

Download Aegis free (opens in a new tab)

2. Ente Auth: encrypted sync across mobile and desktop

Ente Auth syncs the same end-to-end encrypted codes to Android, iOS, desktop, and web apps, and it is free and open source.

The Ente Auth product page documents end-to-end encrypted cloud backup and cross-platform sync. Ente also publishes its client and server code under the AGPL and lists the supported platforms in its public repository.

Account sync depends on Ente’s service, so keep an independent recovery path. Its export documentation covers password-encrypted exports, continuous local backups, and an offline mode for people who do not want account sync.

Aegis remains the simpler option when an Android-only local vault is the goal.

Download Ente Auth free (opens in a new tab)

3. 2FAS: mobile apps with optional cloud backup

2FAS pairs its open-source Android and iOS apps with a browser extension, so fewer codes need copying from the phone to a desktop login. It generates TOTP and HOTP codes, needs no 2FAS account for basic use, and offers optional cloud backup.

Backups use the cloud account already attached to the phone: iCloud on iOS and Google Drive on Android. Cross-platform moves require an exported backup file. 2FAS explains both paths. The browser extension must also be paired with the phone.

It suits mixed-device households and anyone who logs into services from a browser all day.

Download 2FAS free (opens in a new tab)

4. Bitwarden TOTP: best if you already use Bitwarden

Bitwarden’s integrated TOTP generator is a Premium feature worth considering if you already use Bitwarden as your password manager.

Bitwarden TOTP is included because password-manager users may want codes beside their passwords. Bitwarden Free does not include TOTP generation. Bitwarden Premium adds it for all accounts, stores codes in the encrypted vault, and supports browser-extension auto-fill through its open-source clients.

The trade-off is not price alone. TOTP requires the paid plan, Bitwarden is not a standalone 2FA app, and storing passwords plus 2FA codes in the same vault reduces the separation that makes a second factor valuable if the vault itself is compromised.

That trade suits Premium users who value consolidation and understand the reduced separation. Bitwarden lists Premium at $19.80 per year. For higher-risk accounts, a separate authenticator or security key retains a distinct second factor.

Get Bitwarden (free tier) (opens in a new tab)

5. Authy: for existing mobile users

Authy, from Twilio, syncs between compatible iOS and Android devices with optional encrypted backups, but it now carries more caveats than the other apps here.

Setup is tied to a phone number. Authy is closed-source, its cloud backup does not use your own storage provider, and its desktop apps are no longer supported.

Twilio ended the Windows, macOS, and Linux desktop apps on March 19, 2024. In July 2024, Twilio reported that an unauthenticated endpoint had let threat actors identify data associated with Authy accounts, including phone numbers; it said it found no evidence that Twilio systems or other sensitive data were accessed. Read the security notice before deciding whether the phone-number account model fits your risk.

Existing mobile users can continue if they accept those trade-offs. New users can compare the recovery and export controls in Aegis, Ente Auth, and 2FAS. Authy does not provide token export, so migration normally means disabling and re-enabling 2FA for each service. Keep Authy installed until every replacement code has been tested.

Download Authy free (opens in a new tab)

Compare backups, platforms, and exports

Five of the six apps cost nothing, so paying for a second factor usually means one of two things: codes inside a paid password manager, or a hardware key. Vendor prices as of September 2026:

Codes stored in a password manager share its vault, so a hardware key or a separate app keeps the second factor separate for email and banking.

Save backup codes before moving anything

Many services generate one-time backup codes when you enable 2FA. Save them before leaving the setup screen. If you lose the authenticator and have no recovery code or alternate recovery method, regaining access may require a provider-specific account recovery process.

When enabling 2FA, download or print the backup codes immediately. Store them in the password manager vault rather than the authenticator app, since the codes are needed when that app is inaccessible.

For business or shared-team accounts, backup codes should not live only with one person. Store them in the team’s approved password manager or recovery process, limit who can view them, and document who is responsible for regenerating codes after use. A free authenticator app can protect the login, but account recovery still needs an operational owner.

Google Authenticator and account sync

Google Authenticator can store codes locally or sync them through a Google Account. Google’s transfer instructions cover exports between supported devices. Aegis and 2FAS provide open-source alternatives with different backup controls. Whichever path you use, verify the transferred codes before deleting the originals.

Pair encrypted backups with offline recovery codes

Migrate in order of damage: primary email first, then the password manager and financial accounts, testing each login before moving the next. Save each service’s recovery codes somewhere separate from the phone as you go, so a lost device mid-move does not lock out the accounts already transferred.

For a password manager, primary email, financial account, or administrator login, consider a FIDO2 or WebAuthn security key. A physical key can resist common credential-relay phishing that captures TOTP codes, provided the service supports that authentication method. Keep a registered spare or another documented recovery path.