Authenticator app privacy ratings
Authenticator apps for one-time codes.
18 two-factor authentication are rated against 4 public criteria, and 18 have enough evidence for a letter grade. Of the 9 with a known jurisdiction, 6 are based in a Five Eyes country, and 8 in the wider Fourteen Eyes.
Open-source two-factor authentication only · Criteria for this category · Suggest an addition · Markdown
| Name | Grade | Score | Data | Jurisdiction | Open source | No trackers or telemetry | No ads or data sales | Independent audit |
|---|---|---|---|---|---|---|---|---|
Free and open source authenticator app for Android that stores codes in an encrypted local vault. It supports encrypted backups, imports from many other authenticator apps and has no internet permission. |
Grade B | 80 | 100% | – | Yes | Yes | Yes | No |
Open source two-factor authentication app for iOS that stores secrets encrypted in the iOS keychain. The app never connects to the internet. |
Grade B | 80 | 100% | – | Yes | Yes | Yes | No |
Open source browser extension for Chrome, Firefox and Edge that generates TOTP and HOTP codes. Accounts can be encrypted with a password and backed up to a file or the user's cloud storage. |
Grade B | 80 | 100% | – | Yes | Yes | Yes | No |
Open source two-factor code generator for the GNOME desktop, written in Rust. It supports TOTP, HOTP and Steam codes, a GNOME Shell search provider and backups to and from other authenticator apps. |
Grade B | 80 | 100% | – | Yes | Yes | Yes | No |
Open source two-factor authentication app for iOS that supports TOTP and HOTP codes. Tokens are encrypted on the device, with optional encrypted iCloud sync and exports. |
Grade B | 80 | 100% | – | Yes | Yes | Yes | No |
Open source two-factor authentication app sponsored by Red Hat that generates HOTP and TOTP codes. Tokens are added by scanning a QR code. |
Grade B | 80 | 100% | – | Yes | Yes | Yes | No |
Open source fork of FreeOTP for Android that adds backup export and import, search, categories, biometric lock and offline token icons. Generates HOTP and TOTP codes. |
Grade B | 80 | 100% | – | Yes | Yes | Yes | No |
Free and open source two-factor authentication app for Android with encrypted backups, icon packs, categories and a Wear OS companion app. It imports from many other authenticator apps. |
Grade B | 80 | 100% | – | Yes | Yes | Yes | No |
Free, open source authenticator app for iOS and Android from Bitwarden that generates TOTP codes. It works without an account and can optionally sync codes with a Bitwarden password manager vault. |
Grade C | 70 | 100% | United States Five Eyes | Yes | No | Yes | Yes |
Free, open source TOTP authenticator for mobile, desktop and web. Works fully offline, or with an Ente account to sync codes across devices with end-to-end encrypted backups. |
Grade C | 70 | 100% | United States Five Eyes | Yes | No | Yes | Yes |
Free, open source authenticator app from Proton for Android, iOS, macOS, Windows and Linux. It works without an account, and signing in with a Proton account adds end-to-end encrypted sync. |
Grade C | 65 | 100% | Switzerland Outside Eyes | Yes | Partial | Yes | No |
Open source authenticator app for Android and iOS with a browser extension for filling codes. Backups can be encrypted and synced through the user's Google Drive or iCloud without a 2FAS account. |
Grade D | 50 | 100% | United States Five Eyes | Yes | No | Yes | No |
Two-factor authentication app for iPhone, iPad, Apple Watch and Mac that generates one-time codes, with optional iCloud sync and encrypted backups. |
Grade D | 50 | 100% | Germany Fourteen Eyes | No | Yes | Yes | No |
Open source two-factor authentication app for iOS that generates TOTP and HOTP codes. It works without a network connection. |
Grade D | 50 | 100% | – | Yes | No | Yes | No |
Authenticator app from Yubico that stores OATH one-time password secrets on a YubiKey instead of the phone or computer, and generates codes when the key is connected or tapped. |
Grade D | 50 | 100% | Sweden Fourteen Eyes | Yes | No | Yes | No |
Two-factor authentication app from Google that generates time-based and counter-based one-time codes. Codes can optionally be backed up and synced to a Google Account. |
Grade F | 20 | 100% | United States Five Eyes | No | No | Yes | No |
Authenticator app from Microsoft that generates one-time codes for any account and supports push approval, passwordless and passkey sign-in for Microsoft and Entra ID accounts. |
Grade F | 20 | 100% | United States Five Eyes | No | No | Yes | No |
Two-factor authentication app from Twilio that generates one-time codes and supports push approvals, with encrypted cloud backups tied to a phone number. Available for Android and iOS. |
Grade F | 20 | 100% | United States Five Eyes | No | No | Yes | No |
Questions
What is the most private option among two-factor authentication?
No pick has been made yet. The table above is sorted by score, based on public evidence.
How are two-factor authentication rated?
Each entry answers 4 questions: open source, no trackers or telemetry, no ads or data sales and independent audit. Answers need links to evidence. See the full criteria.
Does jurisdiction matter?
Jurisdiction decides which laws can compel a provider to hand over data. Each entry shows its country and whether it is in the Five, Nine or Fourteen Eyes. The data a provider can hand over depends mostly on what it stores and who holds the keys. Read about jurisdictions and the CLOUD Act.