10 best two-factor authentication apps on mobile

Two-factor authentication apps are popular and powerful tools. They let you log into your account with a second line of authentication. Thus, you can keep your accounts secure even if your password is compromised. It’s not an end-all-be-all solution to account security, but it’s so much better than just a password that we happily recommend two-factor authentication to literally everyone.

There are a few decent apps to help out with this. Most of them should follow the standard protocols as well. Here are the best two-factor authentication apps on mobile. We’d also like to give an honorable mention to Duo (Google Play). It’s the hot new protocol service in town, but the app leaves a lot to be desired.

The best two-factor authentication apps for Android

Stats and features comparison

2FAS

A serviceable, simple, and functional option that is also free.

• Pricing: Free
• Platforms: iOS (App Store) and Android (Google Play)

2FAS is a serviceable two-factor authentication app. It works like most of the others. You either scan a QR code or manually input your token info. From there, you obtain a token when needed. The UI is minimal, clean, and useful. The app strips away any complications and just works.

We don’t really have anything negative to say here. It does the job it needs to do and it does so admirably. It supports TOTP and HOTP protocols, which covers the vast majority of websites that offer 2FA support. It’s also free, has no ads, and it works cross-platform with iOS, Android, and as a plugin on your web browser. It’s a solid overall option.

Aegis Authenticator

Aegis Authenticator is a security-focused option with encryption and good features.

• Pricing: Free
• Platforms: Android (Google Play)(F-Droid)

Aegis Authenticator is one of the better options for security-focused people. It is both open-source and encrypted. That means you can audit the code and see just how secure your information is. The TOTP and HOTP support means most websites should work without issue. The app also boasts Google Authenticator support specifically.

The UI is clean and minimal. There are some organizational features that let you put your various tokens into categories for easy reference later. We also quite like that you can back up the app to external storage, such as an SD card, or by using Android’s native app backup. The only downside is the lack of cross-platform support. You can only use this on Android phones.

andOTP

andOTP is one of the older options that work well, but it may not be in development anymore.

• Pricing: Free
• Platforms: Android (Google Play)

andOTP is a solid option for 2FA apps. It features a simple UI, just enough features to make it good, and a clean overall experience. It works similarly to most. You scan your stuff in with QR codes or enter it manually. After that, the app generates tokens. You can back up your stuff in a few different ways, and a couple of those ways are encrypted. It adds a bit of security to the mix.

It’s only available for Android, and it looks like it’s going to stay that way. The developer is officially not working on the app at this time, although his statement on it says he may start again someday. It’s open-source, so we hope this gets forked out into something cool. However, until then, the app still works fine and should for a few years yet before Android platform changes render it useless.

Authey Authenticator by Twilio

Authy by Twilio is a powerhouse app with superior cross-platform support and good features.

• Pricing: Free (for individual users)
• Platforms: iOS (App Store) and Android (Google Play)

Authy by Twilio is one of the most popular two-factor authentication apps. It’s mostly for its cross-platform support. It has native apps for Android, iOS, Linux, macOS, and Windows, and we believe it’s the only reliable choice available on all of those platforms. Some other features include support for a wide range of protocols and websites, along with easy backups.

It’s easy enough to use. You bring your tokens in the same way as you do any other app. You can also password-protect individual accounts or everything if you so choose. The backups are encrypted. Authy boasts the same algorithms that the NSA uses to protect its information. That’s quite the flex. In any case, aside from some clutter and the occasional bug, we didn’t have any issues using this one.

Google Authenticator

A mainstream choice that works well enough with cross-platform support.

• Pricing: Free
• Platforms: iOS (App Store) and Android (Google Play)

Google Authenticator is kind of like the McDonald’s of two-factor authenticators. It’s mainstream, you know the name super well, and it’ll get you where you need to go. Adding tokens to the app is easy, and getting tokens out of the app is also very easy. That’s good news because there are no backup options as of the time of this writing, so exporting to a new phone is the only way to transfer your data.

It’s made primarily for Google accounts and works quite well with that. You can import other sites as well. It supports both TOTP and HOTP protocols, so most websites should work okay. The UI is okay. There isn’t really a way to organize your tokens once imported, but the UI is clean enough to where it isn’t the biggest deal. There are better apps on the list, but this works fine if you want to keep everything with Google.

Microsoft Authenticator

A full service authenticator that also includes password autofill, payment autofill, and more.

• Pricing: Free
• Platforms: iOS (App Store) and Android (Google Play)

Microsoft Authenticator is, if we’re being honest, a better version of Google Authenticator. The UI is just okay, and we wish there were better organization features for it. However, aside from that, what you get here is a decent experience that works well. The native Microsoft account support is quite nice if you have a lot of products that require Microsoft account sign-in. It supports the typical protocols, so it should work for most websites.

However, where this app truly shines is as a double threat. It lets you store passwords, payment card data, addresses, and verified IDs within the app. That functionality allows Microsoft Authenticator to autofill stuff on your phone, so you get the password and 2FA in the same spot. That can save you some app drawer space since you consolidate two functions into a single app.

TOTP Authenticator

TOTP Authenticator by BinaryBoot is a smaller name in this space, but it punches with the big dogs.

• Pricing: Free / $5.99
• Platforms: iOS (App Store) and Android (Google Play)

TOTP Authenticator is a good authentication app. It supports the most popular protocols, so most websites should work. The UI is clean and simple. You shouldn’t have any trouble finding your tokens or copying the code. It works as you would expect without much drama. In fact, it does such a good job doing its core function that there really isn’t much else to write about.

The premium version runs $5.99 in the Android and iOS versions. It adds cloud backups, support for the Chrome extension, and a few other minor features. You can use the app for free and get what you need out of it. However, we do think the free version is a bit bare of features compared to other free options here. It’s still good, but the premium version is obviously the choice if you go with this one.

Per-app authenticators

Those who don’t need a ton of 2FA support can just use apps for those platforms.

• Pricing: Free (usually)
• Platforms: iOS and Android

A lot of services have authenticators specific to their platforms. For example, Battle.net has its own authenticator. The nice thing about apps like this is that you can keep your 2FA tokens separated. However, the downside is that you have to download a new app every time you run into one with its own authenticator. The authenticator apps do work, though, so it’s definitely better than not having 2FA at all.

The other major downside is that a lot of businesses simply don’t do authentication apps typically, so they’re not always done well. For example, a lot of folks have had issues connecting when setting up the aforementioned Battle.net authenticator. It’s not an option we generally recommend. However, some services require it, and in that case, we can’t make any other recommendations, can we?

Other 2FA options

The barebone 2FA experience is still better than nothing.

• Pricing: Free (usually)
• Platforms: Any device with SMS or email

There is a case for using the oldest methods of 2FA, which is the text message or email verification. It works well because you don’t have another app to manage. Texts and emails usually show up pretty quickly these days, and it’s certainly a lot better than not having any 2FA at all. As long as you have unlimited texts and more than 1MB of data on a limited data plan, this option also shouldn’t cost you anything.

There are downsides, though. If someone steals your password and gets into your email, an email 2FA method won’t protect you as a 2FA app would. SMS messages and emails can take a long time to get there, and emails specifically can end up in your spam folder, making them harder to find. It’s not as efficient or clean as a dedicated 2FA app. That said, it’s still a whole lot better than not having 2FA at all.

Two-factor authentication glossary

Here is a list of words about 2FA that you might need to know. The whole industry has its own set of terms that can be confusing to first-timers. The glossary below is in alphabetical order.

• 2FA — Shorthand for two-factor authentication.
• HOTP — HMAC-based one-time password. It’s OATH approved, and also an open protocol. It uses an algorithm to generate a one-time password that lets you log into websites.
• MFA — Multi-factor authentication. In general, two-factor authentication requires two forms of authentication to log in. MFA may require more than two. If more than two are needed, we generally refer to it as MFA.
• OATH — Not to be confused with OAuth, OATH stands for Open Authentication, and is a collaborative effort among tech giants to standardize 2FA for easier, faster use and implementation. TOTP and HOTP are both part of OATH.
• OTP — Shorthand for one-time password. It’s a unique code that you use to authorize a log in after entering your password. OTP is the most common form of two-factor authentication, and everything in the list above generates OTPs for you.
• TOTP — Time-based one-time password. It’s a computer algorithm that generates a unique, one-time code that resets after a specific amount of time. It is the successor to HOTP.

The five authentication factors

Experts state that there are up to five different types of authentication. This isn’t necessarily needed to use 2FA apps and services, but we thought you would enjoy learning about them.

• Knowledge factor — Knowledge factors describe things like passwords, PINs, and other forms of logging in that you know or remember.
• Possession factor — Possession factors are when you use your device to sign in to another service. For example, if I try to log in on Google with my computer, it’ll ask my phone if it’s really me logging in. My phone, which is in my possession, is like my key in this instance.
• Inherence factor — Inherence factors describe things like biometric security. Using your eyes, face, voice recognition, or fingerprints counts as inherence factors. Basically, these things are a part of your body, and you usually don’t lose them
• Location factor — Location factors unlock things based on where you are. Samsung has these features baked into their smartphones under the Smart Lock options. The phone remains unlocked while it’s on your person or when it detects that you’re at home, but locks any other time.
• Behavior factor — Behavior factors are actions you must perform in order to log in. You do this all the time with those little Captchas that make you select all of the images with a specific item in them. Pattern unlocks, and the Windows picture passwords are two more examples.

Any of these methods can be used in a 2FA or MFA environment. Generally speaking, you log into a website with your password (knowledge), unlock your phone with your fingerprint or Face ID (inherence), and then use the 2FA app that generates a code for you (knowledge).

Some sites may require you to fill out a Captcha (behavior) to make sure you’re not a robot. It’s not uncommon to require three or four forms of authentication when getting into a website. It’s annoying sometimes, but it really does help keep you safe.

If we missed any two-factor authentication apps, tell us about them in the comments. You can also click here to check out our latest Android app and game lists.