Which 2FA Authenticator App Lets You Leave — and Which Locks You In

Ask anyone how to secure an account and the answer is “turn on two-factor authentication, get an authenticator app.” That advice stops one step too early. The app you pick decides two separate things that are easy to confuse: whether your codes survive a lost phone, and whether you can ever take them with you to a different app. Most people optimize for the first and only notice the second years later, when switching means re-enrolling every account by hand.

Below are seven authenticator apps, each checked on September 18, 2026 against the vendor’s own support or security page. The two columns that matter are the last two: how your codes get backed up, and whether you can export them to move elsewhere. An app can have a perfect backup story and still be a cage.

App	Price	Platforms	Open source	Backup / sync	Can you export?
Google Authenticator	Free	iOS, Android	No	Cloud sync to your Google Account (added Apr 2023); not end-to-end encrypted	Yes — QR export, up to 10 accounts at a time
Microsoft Authenticator	Free	iOS, Android	No	Cloud backup to a Microsoft account (Android) or iCloud (iOS); restores only same OS	No — TOTP codes cannot be exported
Authy	Free	iOS, Android (desktop retired Mar 2024)	No	Encrypted cloud backup	No — manual re-enrollment
Bitwarden Authenticator	Free	iOS, Android	Yes (GPL-3.0)	Local database; backed up by OS (iCloud / Google One)	Yes — export to file
Ente Auth	Free	iOS, Android, desktop, web	Yes	End-to-end encrypted cloud sync	Yes — plain, encrypted, or CLI
2FAS	Free	iOS, Android	Yes	Sync via your own iCloud or Google Drive	Yes — export .2fas file
Aegis Authenticator	Free	Android only	Yes	Encrypted local vault + encrypted backups	Yes — export / backup

Checked September 18, 2026. Prices and policies change. Sources: Google Authenticator sync, Microsoft Authenticator backup, Microsoft Q&A on exporting TOTP, Authy desktop EOL, Bitwarden Authenticator, Ente Auth, 2FAS Auth, Aegis Authenticator.

Read down the last two columns and the split is sharp: five apps let you export your codes, two do not. The two that do not are also the two with the most reassuring built-in backup — Microsoft Authenticator and Authy both quietly sync your codes to the cloud, which is precisely what makes their missing export button easy to miss until you need it. Sync is about surviving; export is about leaving, and they are different products.

The first caveat is encryption. Google Authenticator’s cloud sync, added in April 2023, is not end-to-end encrypted — Google encrypts the codes in transit and at rest but holds the key itself. Security researchers at Mysk demonstrated this within two days of the launch, and Google said it plans to add end-to-end encryption “down the line.” As of this writing the sync is protected by Google’s server-side encryption only, which means Google can technically read the seeds. That is not a reason to avoid the app; it is a reason to know what the sync is actually buying you.

Microsoft Authenticator has a different lock-in shape: no export at all, and a restore that only works within the same operating system. Back up on an iPhone and you can restore to an iPhone, but not to Android — and even then, Microsoft documents that only the TOTP codes carry over; passwordless and work accounts need re-sign-in. Microsoft’s own Q&A confirms the app has no generic export file for TOTP entries. Switching to Android means re-enrolling every Microsoft-Authenticator account from scratch.

Authy is the cautionary tale the whole category points at. In February 2024, Twilio announced the Authy desktop apps for Windows, macOS and Linux would be retired on March 19, 2024, and later pushed a final update to harden the seed encryption. The desktop app has no export feature, so users who had stored codes there were told by Twilio’s own help center to re-enable 2FA and re-add each token in a new app. A product you were using for years could be taken away with no clean exit — the exact scenario an export button exists to prevent.

The open-source half of the table is where escape hatches are standard. Ente Auth is end-to-end encrypted: your codes sync across mobile, desktop and web, but the server never sees them unencrypted, and the cryptography has been externally audited. It exports your codes in plain text, as an encrypted file, or straight from a command-line tool — no lock-in, by design.

2FAS takes a different route to the same place. It stores your tokens locally and never runs its own sync server; if you want backup, it syncs through a cloud account you already control — iCloud on iOS or Google Drive on Android. Export is a .2fas file, which is JSON you can password-protect so it stays unreadable in a text editor, and you can move codes between iOS and Android with it. The trade-off is that this is a phone app with no desktop client.

Aegis is the most conservative option on the list: Android-only, entirely offline, with codes in an encrypted vault and backups you take yourself. There is no cloud sync at all, which means nothing to leak and also nothing to restore automatically — you are the backup system. It is the right shape for someone who wants zero third parties in the loop and is willing to be disciplined about exports.

Bitwarden Authenticator is the interesting middle case. It is free and open source, but its standalone app stores codes in a local, unencrypted database and leans on the phone’s OS backup — iCloud or Google One — to survive a lost device. You can export to a file, and it can sync with a Bitwarden Password Manager vault if you have one, but by default the standalone codes sit on your device without their own encryption layer. That matters if you were assuming “open source” alone meant encrypted at rest.

So who is each app for? If you want the path of least resistance inside one ecosystem, Google or Microsoft is the easy default — just understand the trade you are making. If you want to be able to leave on your own terms, Ente Auth is the strongest all-around choice for cross-platform, encrypted sync plus export. If you want no third-party server anywhere near your codes, 2FAS or Aegis is the answer, with Aegis for Android-only purists. Authy is the one to avoid for new setups specifically because of its history of closing the door with no exit.

The principle that ties this table together is the same one behind checking what an export button actually produces before you need it: the right time to learn whether you can leave a tool is while you still like it, not after it changes under you. Every one of the “no export” cells in the table above is invisible on day one and catastrophic on day four hundred.

There is also a quieter argument for keeping your authenticator separate from your password manager rather than bundling both. If one app holds your passwords and your second factor, it stops being two factors and becomes one — a single point of compromise. Some people deliberately keep them apart, which is part of why standalone authenticators like Ente or 2FAS exist at all, and why a password manager’s built-in codes are a convenience, not a substitute for thinking about the shape of the failure.

The encryption column deserves one more look, because “open source” and “encrypted at rest” are not synonyms — Bitwarden Authenticator is open source but stores locally unencrypted, while Ente is both. The distinction is the same line that runs through which messaging apps encrypt by default: the label tells you the code is public, not what the defaults do. Read the backup and export columns, not the GitHub star count.

The decision that actually matters is made in ten seconds: pick an app that can export, turn on whatever backup it offers, and store one encrypted export somewhere off your phone. The exact app matters less than the exit. A lost phone is a nuisance for an app that syncs or exports well; it is a weeks-long recovery project for an app that does neither, and the table above is the difference between those two futures.