Authenticator apps hold the secrets behind your six-digit sign-in codes, so losing the phone can mean losing the accounts.
This guide ranks thirteen apps on how a code is recovered, where the app runs, how the licence reads, and whether the vendor ties it to a larger product. Smaller makers rank above large suites.
Vendors can pay for more visibility on this website, for example a higher place in a ranking or more room on a page. Commercial relationships can also affect which products we feature and how prominently. Every vendor link is marked the same, whatever the arrangement behind it. How that works.
In short
What authenticator apps software does
An authenticator app generates time-based sign-in codes or approves push prompts on your phone or computer, adding a second step to passwords for the accounts you protect.
To rank authenticator apps tools we asked, in turn, how much work setup takes, what it truly costs, whether data can be taken back out, whether leaving is possible, and who the product suits. One rule sits on top of those tests: places 1 to 3 go to challengers, vendors outside the best-known brands in a category, wherever the category has them; the established names follow from place 4 in their ranked order. Reasons for the choice of tests, and for skipping a score out of ten, can be read on the how we work page.
Free codes app with encrypted sync on six platforms
Ranked #1 of 13 in Best Authenticator Apps in 2026.
Free tierPublished pricingElsewhere
Ente publishes the licence (AGPL-3.0) and says the whole project is open source, which matters if you want to read what holds your secrets. Tokens come in by QR code, manual secret or bulk import from other apps, and can be exported again.
An offline mode runs without an account. Weak spot: the free account tier is 10GB, and the vendor shows no location for its company on the pages read.
What stands out
encrypted sync
audited cryptography
offline mode
Where it costs you
The Auth page lists no plans, so storage limits come from the separate account pricing page.
No country of establishment is stated, only a Delaware governing law in the terms.
Right for
Someone who wants one codes app across phone, laptop and browser, with sync.
Wrong for
Buyers who need a stated country of establishment.
Not stated by the vendorFree app; optional account storage plans billed monthly or yearly
Mobile codes app with browser extension and Apple Watch option
Ranked #2 of 13 in Best Authenticator Apps in 2026.
Free tierPublished pricingElsewhere
The vendor says its source code is public under an open-source and source-available heading, yet names no licence, so treat reuse rights as unknown.
The companion password manager caps its free tier at 200 items and one extension. Currency is shown only as a dollar sign. The operator is a Delaware corporation per the privacy policy, with no country named.
What stands out
browser extension
Apple Watch
manual backup
Where it costs you
The licence of the public source code is not named on the home page.
Multi-device sync is listed without saying which plan includes it.
Right for
Phone users who also want a browser extension and a watch app.
Wrong for
Anyone who needs sync terms spelled out before installing.
Not stated by the vendorFree tier on the companion password manager; yearly paid tier; business tier announced
Android-only open source app with automatic folder backups
Ranked #3 of 13 in Best Authenticator Apps in 2026.
Free tierOpen sourcePublished pricingElsewhere
Aegis comes from Beem Development and is licensed under GNU GPL v3.0, with two vendored libraries under other licences. Vault exports may be unencrypted or encrypted, and the app can back up automatically to a folder of your choosing.
Home page says automatic backups work but not where they land. Without a cloud option, you carry the job of storing the backup copy elsewhere.
What stands out
Android only
GPL-3.0
folder backup
Where it costs you
It runs on Android only, so an iPhone owner has to pick another app.
The README mentions no cloud backup, so the folder you pick must be copied somewhere safe.
Right for
Android owners who prefer a free app with a visible licence.
Wrong for
Households that mix iPhone and Android devices at home.
Not stated by the vendorFree app, no paid tiers mentioned
Android and Wear OS codes app that avoids remote servers
Ranked #4 of 13 in Best Authenticator Apps in 2026.
Free tierPublished pricingElsewhere
The site calls the project community-backed with no corporate ties and lists a single developer, jmh. The Wear OS app copies its database from the phone so codes work offline.
Licence is GPL-3.0 on the repository. Import from other apps and export are possible at any time. No price is shown beyond the word free, and no country is stated.
What stands out
Wear OS
GPL-3.0
no remote servers
Where it costs you
Only Android and Wear OS are supported, and the watch app needs its paired phone.
The FAQ page returned a 404 error, leaving questions without a vendor answer.
Right for
Android users who want a watch app and no network traffic.
Wrong for
Anyone who wants sync between several phones or laptops.
Not stated by the vendorFree app with no tiers shown
Standalone codes app from a password manager maker
Ranked #5 of 13 in Best Authenticator Apps in 2026.
Free tierPublished pricingNorth America
Bitwarden Inc. is incorporated in Delaware, and the terms define Bitwarden as 8bit Solutions LLC, owned by Bitwarden Inc. The Android repository shows GPL-3.0. Codes can be reached from either app, but the integrated route inside the password manager is premium.
The product page mentions no trial. Because the standalone app describes no sync of its own, moving to a new phone depends on the operating system's backup working.
What stands out
GPL-3.0
OS backup
no account needed
Where it costs you
The page describes no sync, so backup relies on the phone's own OS backups.
Integrated codes inside the password manager are a premium feature.
Right for
Phone users who want a free standalone app that needs no account.
Wrong for
Teams wanting codes and passwords in one free vault.
United StatesFree app on iOS and Android; paid password manager adds integrated codes
Apple-only codes app with Safari extension and iCloud backup
Ranked #6 of 13 in Best Authenticator Apps in 2026.
Free tierPublished pricingElsewhere
Compatibility is concrete: iPhone and iPod touch need iOS 15.6, Mac needs macOS 12.5 and an M1 chip or later, and Apple Vision needs visionOS 1.0.
The home page says iCloud makes codes available on all devices. Whether the source is open is not stated, and the privacy page gives neither address nor country, so the legal entity stays unclear.
What stands out
Apple only
iCloud backup
Safari extension
Where it costs you
It is limited to Apple platforms, with iOS 15.6 or later required on iPhone.
The creator and the App Store seller are named differently and the pages do not reconcile them.
Right for
Apple-only households wanting codes on iPhone, Mac and Apple Vision.
Wrong for
Anyone using Windows, Linux or Android devices as well.
Not stated by the vendorFree on the App Store; also offered through Setapp
iOS codes app with iCloud sync and a Mac companion
Ranked #7 of 13 in Best Authenticator Apps in 2026.
Pricing on requestElsewhere
Copyright is held by Mobime, with no country stated. The licence page splits Source Format from Processed Format and requires explicit permission for the latter, which differs from a standard open-source licence.
Sync goes to iCloud, and encrypted ZIP archives handle backup. A separate macOS companion app sends codes to a Mac. Plans, prices and any free trial are not given on the pages read.
What stands out
iOS
iCloud sync
encrypted ZIP export
Where it costs you
The licence is a custom text, not a standard named open licence.
The privacy page returned a 404 error, so data handling could not be read.
Right for
iPhone owners who want iCloud sync and a Mac companion.
Wrong for
Buyers who need a standard licence or readable privacy terms.
Not stated by the vendorNo plans or prices appear on the home page
Ranked #8 of 13 in Best Authenticator Apps in 2026.
Pricing on requestElsewhere
Per the vendor, credentials stored on the key cannot be extracted, and the key is a portable hardware root of trust, so no cloud backup or sync is described.
Unlocking with FaceID or TouchID is possible. The repository carries Apache-2.0. Yubico is named as maker, but neither the about page nor the imprint shows a registered office, so country is open.
What stands out
YubiKey
secure element
Apache-2.0
Where it costs you
The page shows no prices for the app or for YubiKey hardware.
It does not clearly explain code generation without a YubiKey.
Right for
Users who already own a YubiKey and want codes tied to it.
Wrong for
Buyers wanting a software-only app with cloud sync.
Not stated by the vendorNot stated on the pages read; hardware sold through Buy links
Free codes app with cloud backup under the Twilio brand
Ranked #9 of 13 in Best Authenticator Apps in 2026.
Free tierPublished pricingElsewhere
Authy is branded Twilio Authy and the footer shows Twilio Inc. as copyright holder, though ownership is never spelled out. Twilio's privacy notice names San Francisco as headquarters and Dublin for the EEA, without a country of incorporation.
The home page carries no discontinuation or rename notice. Prices, tiers and platforms beyond mobile app are not shown on the pages read.
What stands out
cloud backup
multi-device
Twilio brand
Where it costs you
The home page does not explain how tokens sync between devices.
Platforms are not named on the pages read beyond the words mobile app.
Right for
People wanting a free app with cloud backup and several devices.
Wrong for
Buyers who need documented sync mechanics or source code.
Not stated by the vendorFree app; no paid tier shown on the home page
Authenticator app sold as part of Duo's workforce editions
Ranked #10 of 13 in Best Authenticator Apps in 2026.
Free tierPublished pricingElsewhere
The pricing page shows Duo Free, Essentials, Advantage and Premier per user per month, with currency shown only as a dollar sign. The app is on the iOS App Store and Google Play.
Owner is Cisco Systems, Inc. per the copyright line, whose privacy statement names San Jose and an EU establishment in the Netherlands without giving a country of incorporation. No trial is named.
What stands out
workforce MFA
Cisco
per-user editions
Where it costs you
The pricing page does not confirm Duo Mobile in each paid edition.
Licences are bought in blocks of ten below 100 users, then blocks of 25.
Right for
Small teams of ten or fewer needing a free admin-managed authenticator.
Wrong for
Individuals wanting a personal codes app with no admin.
Not stated by the vendorFree edition for small teams; paid editions published per user per month
Push and one-time-code app from an identity platform
Ranked #11 of 13 in Best Authenticator Apps in 2026.
Free tierPublished pricingNorth America
The help overview offers two routes: approving a push notification or typing a one-time code. App Store compatibility is iOS 17.0, iPadOS 17.0, macOS 14.0 and visionOS 1.0 or later.
Okta's data lists its headquarters in San Francisco, with addressCountry US. The home page offers a 30-day trial but does not say it covers this app, and the legal page gives no contracting country.
What stands out
push approval
Apple platforms
identity platform
Where it costs you
The help overview does not address backup or sync of enrolled accounts.
The App Store listing requires iOS 17.0 or later.
Right for
Staff whose employer already signs in through an Okta setup.
Wrong for
Individuals looking for a standalone personal codes app.
United StatesFree app on the App Store; organisation licensing is separate
Push approval and passwordless login from a password manager firm
Ranked #12 of 13 in Best Authenticator Apps in 2026.
Pricing on requestElsewhere
The try-it offer on the page carries no card requirement, while the Business plan price shown there belongs to another product and starts with a 14-day trial. The footer names LastPass US LP without a country.
One path on the vendor's site returned a 404 error. Platforms, code backup and sync are not described, and the support article that might say more could not be fetched, so a buyer would have to ask the vendor directly.
What stands out
push login
passwordless
password manager
Where it costs you
The page states no price for the app, only Business plan pricing after a trial.
Platforms and backup of codes are not stated on the pages read.
Right for
Existing LastPass users wanting push approval in the same ecosystem.
Wrong for
Buyers who need six-digit codes, backup or platform details confirmed.
Not stated by the vendorTrial offer without a card on the page; app price not stated
Passwordless sign-in app aimed at Microsoft personal and work accounts
Ranked #13 of 13 in Best Authenticator Apps in 2026.
Open sourcePricing on requestElsewhere
The vendor page directs users to the Android or iOS download and notes availability differs by country or region. Its stated purpose is signing in to Microsoft accounts without a password, personal, work, school or any other account.
No end-of-support or feature-change notice is shown, but nothing on the page covers backup either. The page names no legal entity and the copyright page gives no country of incorporation.
What stands out
Microsoft accounts
passwordless
Android and iOS
Where it costs you
The page does not say whether the app is free or give any price.
It mentions no backup or sync, and the support article on backup returned a 404 error.
Right for
Users whose main accounts are Microsoft personal, work or school logins.
Wrong for
Buyers needing documented backup, pricing or source code.
Not stated by the vendorNot stated on the page; no price shown
An authenticator app generates time-based sign-in codes or approves push prompts on your phone or computer, adding a second step to passwords for the accounts you protect. Rather than compare features, settle the following points one after another.
01
Start with pricing transparency
Prices are public at 9 products (Ente Auth, 2FAS, Aegis Authenticator, Stratum, Bitwarden Authenticator, Step Two, Authy, Duo Mobile, Okta Verify) and on request at the remaining 4, so budget time for quotes if your favourite is in that second group.
02
Ask which country the contract runs through
Headquarters range over 2 countries and 2 regions: Elsewhere 11, North America 2. Legal exposure follows the vendor, not only the data centre, so read the contracting entity before you sign.
03
Check the open source options
Open source here means Aegis Authenticator, Microsoft Authenticator. The price of self-hosting is the time your team spends maintaining it.
Authenticator apps: what happens when the phone dies
Recovery is the real test of an authenticator app, because a code generator is easy and a restored vault is not. Ente Auth syncs codes with end-to-end encryption and also offers an offline mode with no account. Step Two relies on iCloud, while Bitwarden Authenticator relies on the phone's own backups and describes no sync of its own.
Aegis Authenticator backs up to a folder you choose, which means you store the copy. Raivo OTP exports encrypted ZIP archives besides iCloud sync. Test a restore on a spare device before you move every account, and keep the old phone until the restored copy has produced working codes for your most important logins.
Ask where backups land: vendor cloud, iCloud, OS backup or a folder you choose.
Restore onto a second device before retiring the old phone.
Keep one encrypted export outside the app, for example from Raivo OTP or Aegis Authenticator.
Platform reach: Android-only, Apple-only and cross-platform apps
Several of the free apps here fit one platform only, which matters more than any feature list. Aegis Authenticator and Stratum are Android apps, and Stratum adds a Wear OS companion that depends on the paired phone. Step Two covers iPhone, Mac and Apple Vision, and Raivo OTP is iOS with a macOS companion.
Ente Auth lists iOS, Android, web, macOS, Linux and Windows, and Yubico Authenticator spans desktop and mobile. A household with mixed devices should shortlist apps that run on every device, or accept two apps and two backups, since codes cannot move between platforms without an export file, and an export file is itself a secret that deserves care while it exists.
List every device that needs codes before reading feature tables.
Check the minimum OS version, such as iOS 15.6 for Step Two.
Confirm that an export from one app imports into the next.
Authenticator apps bundled with a bigger product
Some entries here are one feature of a workforce or password product. Duo Mobile sits inside Duo editions priced per user, and its pricing page does not confirm the app is in each paid edition. Okta Verify offers push approval or one-time codes, but its help overview does not say whether it works without an Okta setup.
LastPass Authenticator and Microsoft Authenticator mainly describe passwordless sign-in to their own services. Authy sits under the Twilio brand. Bitwarden Authenticator is the exception, a standalone app usable without a Bitwarden account. Ask whether you can keep using the app after leaving the parent product, and what happens to enrolled accounts if the contract ends.
Find out whether the app works without the parent product's account.
Read which edition includes the app before buying seats.
Check the pages for platform and backup statements, which several of these omit.
Open licences, hardware keys and what vendors actually state
Licence wording varies widely. Aegis Authenticator and Stratum state GPL-3.0, Ente Auth lists AGPL-3.0 and Yubico Authenticator carries Apache-2.0 on its repository. 2FAS says its source code is public but names no licence on its home page, and Raivo OTP uses a custom text that requires permission for processed use.
Yubico Authenticator follows a different design altogether: credentials stay in the secure element of a YubiKey and need a touch or NFC tap, but the page does not clearly explain use without one. Read the licence text itself, and note what the vendor leaves unsaid, since a missing statement is not a guarantee in either direction, and neither is a badge on a website.
Open the licence file in the repository instead of trusting a badge.
Ask whether the app needs a YubiKey before counting Yubico Authenticator.
Treat unstated platforms, prices or ownership as open questions, not assumptions.
What goes wrong most often when buying authenticator apps software
Moving every account to a new authenticator app before testing that a backup restores on another phone.
Assuming an app with a polished home page documents its sync, as Authy and LastPass Authenticator leave details unstated.
Choosing an Android-only or Apple-only app, then discovering a laptop or second phone cannot read the codes.
Reading a company's free edition as covering the app, when Duo Mobile and Okta Verify depend on a wider product.
07
Frequently asked questions
7 answers
What is the best authenticator apps in 2026?
Ente Auth leads our ranking of 13. Ente Auth opens the list because it covers the most ground without a charge: iOS, Android, web, macOS, Linux and Windows, with end-to-end encrypted sync and an offline mode that needs no account.
The vendor says its cryptography has been externally audited. The catch is that the Auth page lists no plans of its own, and no country of establishment appears on the pages read.
Which authenticator apps tools publish their pricing?
9 of the 13, with the pricing model each one publishes:
Ente Auth: Free app; optional account storage plans billed monthly or yearly.
2FAS: Free tier on the companion password manager; yearly paid tier; business tier announced.
Aegis Authenticator: Free app, no paid tiers mentioned.
Stratum: Free app with no tiers shown.
Bitwarden Authenticator: Free app on iOS and Android; paid password manager adds integrated codes.
Step Two: Free on the App Store; also offered through Setapp.
Authy: Free app; no paid tier shown on the home page.
Duo Mobile: Free edition for small teams; paid editions published per user per month.
Okta Verify: Free app on the App Store; organisation licensing is separate.
The remaining 4 sell by quote.
Is there a free authenticator apps tool?
Ente Auth, 2FAS, Aegis Authenticator, Stratum, Bitwarden Authenticator, Step Two, Authy, Duo Mobile, Okta Verify have a free plan or free self-hosted edition.
Where are these authenticator apps vendors established?
Vendor countries on this page, Elsewhere 11, North America 2:
Ente Auth: Not stated by the vendor.
2FAS: Not stated by the vendor.
Aegis Authenticator: Not stated by the vendor.
Stratum: Not stated by the vendor.
Bitwarden Authenticator: United States.
Step Two: Not stated by the vendor.
Raivo OTP: Not stated by the vendor.
Yubico Authenticator: Not stated by the vendor.
Authy: Not stated by the vendor.
Duo Mobile: Not stated by the vendor.
Okta Verify: United States.
LastPass Authenticator: Not stated by the vendor.
Microsoft Authenticator: Not stated by the vendor.
Which authenticator apps tools are open source?
Aegis Authenticator, Microsoft Authenticator.
What should you use instead of Ente Auth?
Second is 2FAS, which suits Phone users who also want a browser extension and a watch app.. Third is Aegis Authenticator, which suits Android owners who prefer a free app with a visible licence..
Who should not buy Ente Auth?
Buyers who need a stated country of establishment.. The Auth page lists no plans, so storage limits come from the separate account pricing page..
If a authenticator apps product of yours deserves a place among these 13, say what it is and who it serves. Inclusion rests with us alone. See software advice for the rules.
