Aegis
Free Our pickEncrypted, open-source, and it makes real backups — export the vault, store it with your passwords. Imports from Google Authenticator by QR.
Two-factor codes: replace Google Authenticator
5 private options, our pick first. Every download link goes straight to the source — F-Droid, the developer's GitHub releases (one tap into Obtainium), the Play listing you can install anonymously through Aurora Store, or the official site. None of these are affiliate links. Updated October 2026.
These Google Authenticator alternatives store your two-factor codes on Android with encryption and real backups. Aegis is the main pick for a single phone. ente Auth, 2FAS, Proton Authenticator and Bitwarden Authenticator add sync or cross-device options.
The trade-off is sync versus control. A local vault with exported backups keeps the codes yours alone. A synced app saves you if the phone dies, but adds an account. Either way, a private 2FA app in 2026 should make it easy to replace a lost phone without locking you out of everything.
ente Auth
FreeIf you want codes encrypted-synced across devices.
2FAS
FreeOpen-source, friendly 2FA app with optional encrypted backups and a browser extension.
Proton Authenticator
FreeProton's 2FA app with end-to-end encrypted sync — the easy choice if you're already on Proton.
Bitwarden Authenticator
FreeBitwarden's standalone, open-source 2FA app — no Bitwarden account needed.
Move your 2FA codes before you wipe the old phone. It's the step everyone forgets.
How to switch from Google Authenticator
- Install Aegis and set a strong vault password. Turn on automatic backups to a folder you control, and note where they are saved. The backups are encrypted with the same password.
- In Google Authenticator, use the option to transfer or export accounts. It shows QR codes that Aegis can scan to import your codes in one go.
- Test each code by signing in to the matching site before you remove anything. A code that fails usually means that account needs a fresh 2FA setup.
- Copy an Aegis backup to a second place, such as your computer or encrypted cloud storage. Keep it with your password manager's recovery codes.
- If you turned on Google Authenticator's cloud sync, remove the accounts there and turn sync off. Otherwise copies of your codes stay in your Google account.
- Only then wipe, sell or hand down the old phone. Moving 2FA codes is the step people forget, and it is the one that locks them out of their accounts.
Two-factor codes questions
Will my bank accept these authenticator apps?
If your bank offers an authenticator app option, it almost always uses the standard time-based codes that Aegis, ente Auth and 2FAS generate. Many banks instead confirm logins in their own app or by SMS, and those methods can't be moved into a third-party authenticator. Check your bank's security settings to see which methods it offers.
What happens to my codes if I lose my phone?
With Aegis, you restore the encrypted backup file you saved elsewhere, using your vault password. With ente Auth or Proton Authenticator, you sign in on the new phone and the encrypted sync brings the codes back. If you have neither, you will need each site's recovery codes, which is why saving them during setup matters.
Can Aegis import codes from apps other than Google Authenticator?
Yes. According to the project, Aegis imports from 2FAS, Authy, andOTP, FreeOTP, FreeOTP+, Microsoft Authenticator, Steam and others, though some of those imports need root access. It can export to plain text or an encrypted file, so you are not locked in if you switch apps later. Export a fresh copy after adding new accounts.