Aegis Authenticator is a free, open-source Android app for storing two-factor authentication tokens. It supports the common HOTP and TOTP standards, encrypts its vault, and offers manual exports and automatic backups. Its appeal is control: you manage the vault password and decide where backups go. That also means planning recovery before you lose or replace your phone.
What Aegis Authenticator does
The Aegis project describes the app as a free, secure, open-source 2FA app for Android. It stores the codes used for time-based one-time passwords (TOTP) and counter-based one-time passwords (HOTP). The project says this makes it compatible with thousands of services; F-Droid notes that services supporting Google Authenticator generally work with Aegis. That compatibility does not make Aegis a universal replacement for passkeys, hardware security keys, or service-specific authentication methods. Aegis project documentation and F-Droid listing
As an Amazon Associate I earn from qualifying purchases.
An authenticator app generates codes; it does not by itself prevent phishing or account takeover. Protect the accounts that matter with the strongest authentication options each service supports, and keep that service’s recovery codes or other recovery method somewhere safe.
How Aegis protects its vault
Aegis documents AES-256-GCM vault encryption. Password unlocking uses scrypt, and biometric unlocking relies on a key held in Android Keystore. The project also lists screen-capture prevention and tap-to-reveal as features. These are documented protections, not a guarantee against every compromise of a device, operating system, cloud account, or user account. Aegis project security documentation
#1 Best Overall
- PACH & COMPANY LCKYSN LOCK AND KEY FOR AEGIS 7000
Keep the vault password recoverable to you: the project warns that forgetting it can mean losing access to the vault. Biometrics are convenient, but the FAQ notes that some device implementations can be buggy. A password reminder is useful; it is not a substitute for remembering or securely recording the password. Aegis FAQ
Ways to add tokens or move them from another app
You can add a token by scanning its setup QR code, scanning an image of the code, or entering the details manually. When enabling two-factor authentication on a service, keep its recovery codes before closing the setup process. If the service offers a choice, Aegis can use the same standards-based QR setup used by Google Authenticator-compatible apps.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
The project documents import options for 2FAS Authenticator, Authenticator Plus, Authy, andOTP, FreeOTP, FreeOTP+, Google Authenticator, Microsoft Authenticator, Steam, TOTP Authenticator, and WinAuth. Compatibility depends on the source app’s export method; some imports require root access when the original app has no export option. For Authenticator Plus, the FAQ specifies an export-file requirement and says its .db format is unsupported. Do not assume every app backup can be imported directly. Aegis import documentation and Aegis FAQ
Backups, exports, and cloud storage
Aegis distinguishes automatic backups from manual exports, although both use the same vault-file format. You can choose encrypted or plaintext export; for ordinary backup storage, use an encrypted export rather than leaving the token data in plaintext. The FAQ says the vault password is used for encrypted export and import. Aegis project documentation and Aegis FAQ
Rank #3
- FIPS 140-2 Level 3 Validation (pending 1 Q 2019)
- Aegis Configurator Compatible
- Separate Admin and User Mode
- Two Read-Only Modes
- Data Recovery PINs
Automatic cloud backup
Automatic cloud backup depends on a provider app that fully participates in Android’s Storage Access Framework. Aegis says the app itself has no internet access and cannot add integrations for individual cloud services. The FAQ names Nextcloud as a known compatible provider. Another documented approach is to save backups to a local folder and use a separate sync app. A file synced to a cloud account still depends on the security of both the encrypted vault and the account that stores it. Aegis FAQ
Removable storage
A USB flash drive is optional: it can hold a manually managed encrypted export, but Aegis does not require a drive or specify a model or capacity. Keep the export encrypted and store the drive somewhere separate from the phone so one incident is less likely to affect both copies.
Rank #4
- FIPS 140-2 Level 3 Validation
- Aegis Configurator Compatible
- Separate Admin and User Mode
- Two Read-Only Modes
- Data Recovery PINs
Prepare to switch phones without losing access
- Make a backup before changing devices. Create an encrypted export or confirm that automatic backup has completed. Do not rely on a backup setting you have not verified.
- Keep the vault password available. You will need it to unlock the vault and, according to the FAQ, to import an encrypted export.
- Install Aegis on the new Android phone and restore the vault. Use the encrypted backup or supported automatic-backup route, then check that the expected tokens appear.
- Test account access before wiping the old phone. Sign in to important services using a generated code and confirm that your recovery methods are available. Keep the old device until you have checked the accounts you rely on.
A backup is only useful if it can be restored. A test before the old phone is erased can reveal a missing file, forgotten password, or unsupported import path while the original tokens are still available.
Android availability and other platforms
F-Droid’s package listing, accessed October 7, 2026, reports version 3.4.3, added September 9, 2026, and requires Android 6.0 or newer. Release details can change, so check the listing for the current version and requirement. The Aegis FAQ says the project has no plans for iOS, Windows, macOS, or browser-extension ports. F-Droid package listing and Aegis FAQ
Best Value
- Fips 140-2 Level 3 validation (pending 1 Q 2019)
- Aegis Configurator compatible
- Separate Admin and User mode
- Two Read-Only modes
- Data recovery pins
For installation trust, distinguish distribution channels rather than treating every APK as equivalent. The project says Google Play and GitHub APK releases are signed with the same key and documents how to verify them; F-Droid provides its own build metadata and reproducibility links. Follow the current instructions for the channel you choose. Aegis project documentation and F-Droid package listing
Who should consider Aegis?
Aegis is a practical fit for Android users who want a free, standards-based authenticator and are comfortable managing an encrypted vault and its backups. It is less suitable if you need an official app across Apple and desktop platforms, or if you expect every authenticator’s private database to import without extra steps. Your choice should account for where tokens can be restored, not just how they are generated.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →
