Best Authenticator Apps for Backup and Recovery

Losing your phone should not mean losing every account, but with the wrong authenticator setup, that is exactly what happens. The six-digit codes that protect your email, bank, and social accounts live in an app, and what happens next depends entirely on how that app stores them. This guide compares six authenticator apps on backup, sync, export, and recovery, using published specifications from the apps’ official pages. It does not report hands-on testing. Prices are as of 27 October 2026; check the provider’s site for current pricing.

Which authenticator app survives a lost phone?

On paper, Ente Auth and Proton Authenticator leave the fewest lost-phone traps. Both sync codes across devices with end-to-end encryption when you use an account, both offer an export path, both work without an account if you prefer that, and both have desktop apps. Ente Auth adds web access to synced codes. This is spec-based reasoning from published specifications, not a test result, and the right pick still depends on your phone, your platforms, and whether you will actually set up a backup.

The recovery comparison

App	If the phone is lost, what restores	Restores from	What breaks
2FAS	Codes, if a backup was enabled	Your own encrypted iCloud or Google Drive backup	No 2FAS account to recover from; no backup enabled means codes only on the lost phone
Aegis	Codes, if a vault backup file exists outside the phone	A vault backup file saved to a location of your choosing	Android-only; no account recovery; no vendor cloud; no backup file means resetting two-factor account by account
Ente Auth	Full code set, if using an account	End-to-end encrypted cloud copy, on any new device or at auth.ente.com	Offline-mode codes were never uploaded and cannot be recovered from Ente; losing the 24-word recovery key plus password locks the synced copy, and the key cannot be rotated
Microsoft Authenticator	Personal and third-party codes, if backup was on	Cloud backup, restored during setup	Same device type only; work and school credentials are not backed up; passwordless credentials are not backed up; backup mechanism changes on Android from January 2027
Google Authenticator	Full code set, if Google Account sync was on	Google Account sync, automatic on sign-in	Without sync, QR transfer needs the old phone in hand; with the phone gone and no sync, the official guidance is to visit every site, remove codes, and relink
Proton Authenticator	Full code set, if using a Proton Account	End-to-end encrypted sync; encrypted backups; user-chosen export	Without an account, codes are local-only; export format is not stated on official pages read

Across the six apps, five need no account to generate codes, four are open source, all six are free at base, five offer a cloud restore path without the old phone, and only three restore cleanly when you switch between iPhone and Android. Cloud restore path here means restore from a cloud backup or sync configured in the app, not a manually moved backup file. Cleanly here means account sync that restores automatically on the other platform, without a manual file move. Portable file export, meaning an export file you can carry to another device, is documented for three: Aegis, Ente Auth, and Proton Authenticator. The official pages reviewed for this guide did not establish passkey storage as a feature of any of the six apps.

The six apps, one by one

2FAS

2FAS Auth is free forever, with no tiers, no ads, and no telemetry, and it is open source under GPLv3. It needs no 2FAS-hosted account: backup and sync use your existing iCloud or Google Drive, and codes are encrypted on the device before upload. It runs on iOS and Android, plus browser extensions for Chrome, Firefox, Edge, Safari, Brave, and Opera, and it generates TOTP, HOTP, and Steam Guard codes. You can import from Google Authenticator by QR transfer. Do not confuse it with 2FAS Pass, the separate password manager, whose Premium tier has nothing to do with Auth. A portable file export path is described by third parties but was not verified on an official 2FAS document read, so this guide claims only the iCloud and Google Drive backup path.

Aegis Authenticator

Aegis is free and open source under GPLv3, and it is Android-only, available on Google Play and F-Droid. Its vault is encrypted with AES-256-GCM and unlocked with a password or biometrics, with screen-capture prevention and tap-to-reveal. It generates HOTP and TOTP codes, exports plaintext or encrypted vault files, backs the vault up automatically to a location of your choosing, and imports from 2FAS, Authy, Google Authenticator, Microsoft Authenticator, and others. No account or sign-in step appears in its official materials, which is a statement about its local-vault design rather than an explicit no-account sentence. The whole plan here is backup-file discipline: without a vault file outside the phone, there is no recovery, and switching to iPhone means leaving Aegis entirely.

Ente Auth

Ente Auth is free and open source, with cryptography described as externally audited. It needs no account, and with an account, codes are encrypted on the device before they sync, so Ente’s servers store only encrypted copies. It runs on Android, iPhone, Mac, Windows, and Linux, plus web access to synced codes at auth.ente.com, and it generates TOTP and HOTP codes. It offers an encrypted export and automatic local backups. Two warnings matter. First, the 24-word recovery key cannot be changed or rotated for an existing account, so keep it somewhere reachable without signing in to the account it protects. Second, codes created in offline mode were never uploaded, so a lost phone with no export means those codes are gone.

Microsoft Authenticator

Microsoft Authenticator is free, on iOS and Android, and its backup requires a Microsoft personal account sign-in. It backs up one-time password codes for eligible Microsoft personal accounts and third-party accounts, with LinkedIn and Facebook given as examples. It does not back up work or school account credentials, only the account name, so those must be registered again on the new device, and passwordless sign-in credentials are likewise not backed up. Restore works only on the same device type: an iOS backup cannot restore on Android, and vice versa. On Android, from January 2027, backup will no longer use the Microsoft personal account, and users will need to enable Microsoft Authenticator from Google One backup, so check current Microsoft docs before relying on the old flow. Microsoft Authenticator was also in the news in October 2026 when Enclave disclosed AuthMask (CVE-2026-80097, CVSS 8.6), a patched Android flaw affecting versions below 6.2606.4246, and the disclosure as cited here does not state a victim count or in-the-wild exploitation. That disclosure is news context, not a verdict on the app.

Google Authenticator

Google Authenticator is free, on Android and iOS, and it needs no account for basic use: the support page says to tap Use without an account on first open. With a Google Account signed in, codes sync across devices automatically, and multiple Google Accounts can sync to the same device. Google says it encrypts Authenticator codes both in transit and at rest, and this guide does not upgrade that statement to end-to-end encryption, because the official page does not describe the synced copy that way. Without an account, transfer needs the old device in hand to create a QR code, and codes generate offline. An optional Privacy Screen asks for a PIN, pattern, or biometric before the app opens. If codes are synced, the official lost-device guidance is to remove the device from the Google Account; if they are not synced, it is to visit every site, remove the codes, and relink the new device.

Proton Authenticator

Proton Authenticator is completely free on all platforms, with no ads and no tracking, and it is open source. You can use it without an account, with no signup, phone number, or email needed, and with a Proton Account, codes sync across devices with end-to-end encryption. It supports encrypted backups when using a Proton Account or on iOS, and you can export codes to a secure location of your choosing, though the export format is not stated on official pages read. It imports from Google Authenticator, 2FAS, Aegis, Bitwarden Authenticator, Ente Auth, and LastPass Authenticator, by CSV or QR code. It runs on iPhone, iPad, Apple Watch, Mac, Android, Linux, and Windows, plus F-Droid, and it works without an internet connection.

Password-manager options, briefly

Bitwarden Authenticator as a standalone app is free and open source, on iOS 15 and above and Android 9 and above, needs no Bitwarden account for standalone use, and generates TOTP codes with a 30-second rotation. Transfer works through an export file or a vault export. Note the distinction: one-time passwords inside Bitwarden Password Manager are a separate integrated feature, not part of the free standalone app. 1Password saves one-time passwords in Login items across its apps, browser extension, and 1Password.com, with QR or manual secret setup and autofill, and it requires a 1Password account. As of 27 October 2026, Individual costs $3.99 per month regular, or $2.99 per month for the first 12 months on annual billing for new customers subscribing directly through 1Password.com, and Families costs $5.99 per month regular, or $4.49 per month first-year promo, for 5 users, with no permanent free tier stated. 1Password’s passkey support is confirmed on its official support pages.

Pick by your situation

Android-only and want local control: Aegis, with the understanding that your backup file is your only recovery path.
Will never leave one phone platform: Google Authenticator with Google Account sync, or Microsoft Authenticator with backup on, keeping in mind the same-type-only restore trap and the January 2027 Android backup change.
Want no account and browser convenience: 2FAS, keeping in mind that its cross-platform file move is not verified on an official document read.
Want the fewest lost-phone traps on paper: Ente Auth or Proton Authenticator, with the Ente recovery key kept safe and the Proton export set up.
Already pay for a password manager: Bitwarden vault TOTP or 1Password, with the price and free-versus-integrated distinctions above kept exact.

Three traps to check before you switch

First, Microsoft Authenticator restores only on the same device type, and its backup mechanism changes on Android from January 2027, so check current Microsoft docs before you rely on either fact. Second, Google Authenticator without sync leaves you with the official worst case: visiting every site to remove codes and relink, because QR transfer needs the old phone. Third, Ente Auth offline codes were never uploaded, and its 24-word recovery key cannot be rotated, so an offline setup plus a lost phone plus no export means the codes are gone.

Frequently asked questions

Do I need an account to use an authenticator app? Five of the six apps state that no account is needed to generate codes. For Microsoft Authenticator, the official pages reviewed establish only that a Microsoft personal account sign-in is required for backup; whether codes can be generated with no sign-in at all was not stated on those pages.

What happens if I lose my phone with no backup? With no backup anywhere, the codes live only on the lost phone, and the official path is to reset two-factor account by account at each service. That is true for every app here, which is why the backup must be set up the day you install the app.

Are synced codes end-to-end encrypted? Ente Auth, Proton Authenticator, and 2FAS all describe end-to-end encryption on their official pages; 2FAS states encryption is performed on-device and the keys never leave the device. Google describes its synced copy as encrypted in transit and at rest, which this guide does not upgrade to end-to-end encryption.

Was anything here tested hands-on? No. This is a buying guide based on published specifications from official pages, and its picks are spec-based reasoning, labelled as such.

Sources

Prices are as of 27 October 2026. Check the provider’s site for current pricing before you decide.

Hero image: Hand holding a smartphone with a blank white screen by Santeri Viinamäki, licensed CC BY-SA 4.0, via Wikimedia Commons.