# 2FAS privacy rating

Open source authenticator app for Android and iOS with a browser extension for filling codes. Backups can be encrypted and synced through the user's Google Drive or iCloud without a 2FAS account.

## Summary

2FAS scores 50 out of 100 (grade D) on the two-factor authentication criteria. It meets 2 of 4 criteria: open source and no ads or data sales. It does not meet no trackers or telemetry and independent audit. It is based in the United States: Five Eyes member; subject to the US CLOUD Act.

- Website: https://2fas.com
- Source code: https://github.com/twofas/2fas-android
- License: GPL-3.0
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Home page trackers: none found
- Category: [Two-factor authentication](https://privacyratings.com/two-factor-authentication/)
- Grade: D (50/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Yes | GPL-3.0. | https://github.com/twofas/2fas-android/blob/main/LICENSE |
| No trackers or telemetry | No | Exodus finds Google Crashlytics in the Android app, and the privacy policy says Google Analytics is used. | https://reports.exodus-privacy.eu.org/en/reports/com.twofasapp/latest/ |
| No ads or data sales | Yes | The apps are free and donation-supported, and the privacy policy says personal information is never sold. | https://2fas.com/privacy-policy/ |
| Independent audit | No | No independent audit is published. |  |

Source: https://privacyratings.com/two-factor-authentication/2fas/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/two-factor-authentication/2fas.md