Updated August 2026 · Verified against the Play Store listings on 19 August 2026 · every app now carries its store link, and the Authy section has been rewritten around what Twilio publishes itself
Aegis is our best overall because its Play listing, read 19 August 2026, shows 4.7 stars from 6,189 ratings, no ads, nothing sold and no data collected. Ente Auth is our pick for backup you do not manage because Ente's own documentation, read 19 August 2026, calls it a free, end-to-end encrypted authenticator. Google Authenticator is the compatibility default because Google's help page, read 19 August 2026, documents free syncing of codes to a Google Account. Data checked: 19 August 2026.
Six authenticator apps for Android, each read against its own Play listing and its own developer's documentation. Two questions separate them, and neither is about the six digits: where the backup lives, and whether you can ever take your codes somewhere else. The table answers both before you scroll. If you have not turned on two-factor authentication yet, start with our guide to setting up two-factor authentication on Android.
Full control
4.7 stars from 6,189 ratings · 500K+ installs · free, no in-app purchases · no ads · Data safety reports no data collected · by Beem Development · Play listing updated 24 February 2026 · checked 19 August 2026 · Play listing
The strongest listing on this page and the only one whose Data safety section reports no data collected at all. Nothing syncs anywhere unless you arrange it, which is the whole point and also the whole cost: the backup is a file, and it is yours to keep somewhere safe.
Skip it if you want a backup you never have to think about, because Aegis deliberately does not offer one. Choose it over Ente Auth when you want nothing at all to leave the phone, and accept that recovery is entirely your job.
Backup you do not manage
4.6 stars from 2,450 ratings · 100K+ installs · free, no in-app purchases · no ads · Data safety reports no data shared with third parties · by Ente Technologies, Inc. · Play listing updated 31 July 2026 · checked 19 August 2026 · Play listing
This is the app that closes the gap the rest of this page leaves open. Aegis gives you encryption and no cloud; Google gives you a cloud but claims only encryption in transit and at rest. Ente Auth claims both, in its own documentation, in one line rather than in marketing.
Skip it if you refuse to keep any copy of your seeds off the phone, in which case Aegis is the honest answer. Choose it over Google Authenticator whenever the encryption of the backup matters to you, since Google claims encryption in transit and at rest and Ente claims end to end.
Work and school accounts
4.6 stars from 2,760,182 ratings · 100M+ installs · free, no in-app purchases · no ads · Data safety says the app may share data with third parties · by Microsoft Corporation · Play listing updated 20 July 2026 · checked 19 August 2026 · Play listing
The obvious choice if a workplace already asks for it, and a competent code generator for everything else. It carries by far the largest rating base on this page, 2,760,182 ratings at 4.6 stars. What it is no longer is a password manager, and its backup has a limit that only bites at the worst moment.
Skip it if nothing you sign in to is a Microsoft or work account, because the push approvals are most of what you are getting. Choose it over Google Authenticator when a workplace asks for it by name, since that is the case its push and certificate features were built for.
No account at all
4.3 stars from 32,417 ratings · 5M+ installs · free, no in-app purchases · no ads · Data safety reports no data collected · by 2FAS · Play listing updated 12 March 2026 · checked 19 August 2026 · Play listing
The middle ground between handing your seeds to a vendor and managing every backup by hand. It asks for nothing: no sign-up, no email, no account. The browser extension is the reason most people stay, and it is built so that the phone always has the final say.
Skip it if you want the browser step to happen without touching the phone, because 2FAS deliberately makes you approve each request. Choose it over Aegis when you want a cloud backup and a desktop workflow without creating an account anywhere.
Compatibility
3.9 stars from 674,875 ratings · 100M+ installs · free, no in-app purchases · no ads · Data safety reports no data shared with third parties · by Google LLC · Play listing updated 22 July 2026 · checked 19 August 2026 · Play listing
Still the default, still the app every setup page shows a screenshot of, and the one with the widest gap between what people assume and what Google actually says. Codes do sync to your Google Account now. What Google claims for that sync stops short of end-to-end encryption, and the rating, 3.9 from 674,875 ratings, is the second lowest here.
Skip it if you want a backup that its own maker cannot read, because Google's wording does not claim that. Choose it over 2FAS only for the sync that arrives with a Google sign-in and needs no thought, and read the encryption sentence above before you do.
Existing users only
3.7 stars from 96,592 ratings · 10M+ installs · free, no in-app purchases · no ads · Data safety says the app may share data with third parties · by Authy, a Twilio company · Play listing updated 18 August 2026 · checked 19 August 2026 · Play listing
Authy is not abandoned, and anyone repeating that is out of date: the listing moved on 18 August 2026. The case against adopting it now is different and harder. There is no supported way to take your codes out, and Twilio changed what the app collects in February 2026.
Skip it if you are choosing fresh in 2026, because the absence of an export makes the decision very hard to reverse. Choose it over nothing here if it already holds your codes and works, since moving off it is the expensive part, not staying.
Why SMS is weaker
An authenticator app and an SMS code look identical from the outside: both prove you are holding your phone. They are not equivalent, and the difference is not a matter of taste.
A code from an app is computed on the device from a shared secret using the TOTP algorithm, published as RFC 6238, so nothing crosses the network for anyone to intercept. An SMS code travels over the phone network, and the phone number it travels to can be taken. In a SIM swap, an attacker persuades a carrier to move your number onto their SIM, and from that moment every text code arrives on their device instead of yours.
The standards body is explicit about it. NIST SP 800-63B-4, published in July 2025 and superseding the 2020 edition, classifies telephone-network delivery as a restricted authenticator. Its authenticator requirements say directly: "Use of the PSTN for out-of-band verification is restricted." Restricted is a defined term with obligations attached. NIST says accepting one requires the organisation "to assess, understand, and accept the risks associated with that authenticator and acknowledge that risks will likely increase over time", and that it must "Offer subscribers at least one alternative authenticator that is not restricted", give "meaningful notice regarding the restricted authenticator's security risks", and "Develop a migration plan for the possibility that the restricted authenticator will not be acceptable in the future".
That day has a date on it in at least one place. Microsoft's retirement notice for Entra ID says that from 1 September 2026 passkeys "become the default authentication experience" and are switched on automatically for anyone still using SMS or voice, and that "Beginning February 1, 2027, Microsoft-provided SMS and voice delivery will be retired in Microsoft Entra ID". That covers work and school accounts rather than your personal email, but it is a large vendor putting a date on the thing NIST only classified.
The rule for you is simpler: if an account offers an authenticator app, use it, and keep SMS only where nothing else is on offer.
Before you need it
Whichever app you pick, three things decide whether a lost phone is an afternoon of nuisance or a month of account recovery. Do them on the day you set it up, not later.
One more habit worth the minute it costs: if you keep the authenticator on a phone other people occasionally hold, gate it behind a separate lock. Google Authenticator has Privacy Screen, Aegis and 2FAS both take a passcode or biometric, and the rest can sit behind one of the app lock apps for Android.
What comes next
Passkeys are the direction of travel, and they solve a problem TOTP codes do not. A passkey is a key pair on your device that you unlock with a fingerprint or face, and there is nothing to type, so there is nothing to phish. The FIDO Alliance puts it in one line: "Unlike passwords, passkeys are always strong and phishing-resistant." A six-digit code, by contrast, can be read aloud to the wrong person on a convincing phone call.
On Android the storage question has an answer worth knowing, because it is the reverse of the one above. Google's own developer documentation says that "On many devices, Credential Manager stores passkeys to Google Password Manager by default" and that "Users can choose other password managers as its passkey providers in the System Settings on Android 14 or higher". The same page states: "When a user creates a passkey with Google Password Manager, it's synchronized and end-to-end encrypted."
Note the asymmetry inside Google's own products. Google uses the phrase end-to-end encrypted for passkeys in Google Password Manager. For Authenticator codes it says something narrower, that they are encrypted "both in transit and at rest across our products". Both sentences were read on 19 August 2026, on Google's own pages, and the gap between them is the reason the Authenticator section above carries the caveat it does.
None of that retires your authenticator app yet. Plenty of accounts still offer only a password plus a six-digit code, and many that support passkeys keep TOTP as the fallback for a lost device. The sensible arrangement in 2026 is a passkey wherever a site takes one, an authenticator app for everything else, and SMS only where there is no other option at all.
2FAS or Google Authenticator. 2FAS asks for no account at all and says on its own listing that it works offline. Google Authenticator syncs the moment you sign in with a Google account. If you want the backup encrypted so nobody but you can read it, Ente Auth does that free. If you want no cloud at all, Aegis. Checked 19 August 2026.
You fall back on the recovery codes each service gave you when you switched 2FA on. If you saved them, an evening restores everything. If you did not, you are into each service's own account recovery, one account at a time, which takes days and sometimes fails. The backup matters more than which app you pick. Checked 19 August 2026.
Yes, and by more than opinion. NIST SP 800-63B-4, published July 2025, classifies telephone-network delivery as a restricted authenticator, obliging any organisation that offers it to also offer an unrestricted alternative, to warn users of the risk, and to plan for the day it stops being acceptable. Microsoft has set that day for Entra ID work accounts: 1 February 2027. The attack is SIM swap, where your number moves to someone else's SIM and every text code follows. Checked 19 August 2026.
Google does not say that it is. Its help page claims only that codes are encrypted in transit and at rest across Google's products, wording that leaves the keys with Google. Google does use the phrase end-to-end, on its own developer pages, for passkeys in Google Password Manager, so the difference in wording is worth noticing. For codes described as end-to-end encrypted, Ente Auth says so outright; otherwise skip sync and use the manual QR transfer. Checked 19 August 2026.
That depends far more on the app you are leaving than the one you are joining. Aegis names what it imports from: Authenticator Plus, Authy, andOTP, FreeOTP, FreeOTP+, Google Authenticator, Microsoft Authenticator, Steam, TOTP Authenticator and WinAuth, with root access needed for those that have no export of their own. Google Authenticator exports by QR code. Authy has no supported export, so leaving it means switching 2FA off and on again at every service while the old phone still works. Checked 19 August 2026.
None of the six. All are free to install, none carries the Contains ads label and none sells an in-app purchase, read on 19 August 2026. Aegis and 2FAS run on donations under GPL-3.0, Ente Auth is the free product of a company whose photo storage is paid, and Google, Microsoft and Twilio each ship theirs beside a larger business.
Not yet, and probably not entirely. Use passkeys wherever a site takes one, since the FIDO Alliance is right that they are phishing-resistant in a way a typed code is not. But many accounts still offer only a password plus six digits, and several that support passkeys keep an authenticator as the fallback for a lost device. Checked 19 August 2026.
Checked 19 August 2026: this page named five apps and linked none of them, so each now carries its own store link and its own dated figures, and Ente Auth is added as the only free authenticator here with end-to-end encrypted cloud backup. The corrections that change advice: the claim that Twilio's "consumer feature development has gone quiet" is contradicted by the record, since the Android listing was updated on 18 August 2026 and Twilio's docs of 20 July 2026 still commit to maintaining the app, so the section now argues from the two things that are true, the complete absence of a supported export and the device data the app has processed since 23 February 2026. The July 2024 Twilio security alert about phone numbers exposed through an unauthenticated endpoint was missing from the page entirely and is now quoted from Twilio. "One QR holds up to ten accounts" is published by Google nowhere and is replaced by Google's actual wording. The description of Privacy Screen was wrong: Google documents it as a verification required before the app can be used, not a way to hide codes in the background. Aegis was said to import from 2FAS, which is not on the developer's own list. The claim that 2FAS backs up to Google Drive or iCloud is supported by no 2FAS page. Microsoft's password removal now carries Microsoft's own four-step timeline and the limit the page never mentioned, that a backup made on iOS cannot be restored on Android. A decision table, an "Our answer" capsule, the NIST classification of SMS as restricted, a dated verification box and this changelog are new.
How to Recover Deleted Photos on AndroidPhoto & Video