Free tools Windows power users keep installed
One-click scans. No signup required.
There is no universally best authenticator app. The right choice depends on what happens when your phone is lost, replaced or reset: where your codes are stored, what unlocks the backup, whether restoration works across iPhone and Android, and whether you need push approvals or passkeys in addition to ordinary one-time codes. Compare the recovery design first, then the interface.
What an authenticator app actually protects
Most authenticator apps generate time-based one-time passwords (TOTPs). After you scan a service’s setup QR code, the app stores a secret and calculates a new six-digit code at regular intervals. Code generation is normally offline, so a phone without mobile service can still produce a valid code.
As an Amazon Associate I earn from qualifying purchases.
The app is only one part of two-factor authentication. The service you are signing in to still controls whether TOTP is accepted, and it should provide recovery codes or another verification method. A backup of the app’s database does not automatically restore access to every account, particularly accounts that use a provider’s own passwordless or push-sign-in system.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Think of backup as a recovery design rather than a checkbox. You need to know:
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- where the encrypted or exported data is stored;
- which account, password, recovery key or original device is needed to unlock it;
- whether a restore can move between Android and iOS;
- which account types are included; and
- how you will sign in if the backup itself is unavailable.
At-a-glance comparison
| App | Backup and encryption model | Recovery dependency | Platform and transfer limits | Distinctive features | Best fit |
|---|---|---|---|---|---|
| Google Authenticator | Optional Google Account sync; local-only storage is also available. Manual QR export/import is supported. | Sync recovery depends on the Google Account. Local-only use depends on the old device or a manually saved transfer. | QR transfer requires access to the old device. The help documentation does not promise a universal cross-platform restore workflow. | Offline codes, Privacy Screen and additional-verification guidance. | People who want a simple app with a choice between automatic sync and local control. |
| Microsoft Authenticator | Cloud backup for supported accounts. Scope differs by account type. | Restore requires the backup account and, for some accounts, another sign-in after restoration. | Current documentation limits restore to the same device type. | Push approvals and Microsoft Entra passkeys are separate from generic TOTP restoration. | Microsoft-account, work or school users who also need the platform’s sign-in methods. |
| Ente Auth | End-to-end encrypted multi-device sync plus import/export. Export encryption uses a password-derived key and XChaCha20-Poly1305 in the documented format. | Your Ente password and recovery key are central to regaining access. No-backup mode leaves data on the device. | Apps are available for mobile, desktop and web, with documented import/export. | Open-source clients and encrypted sync designed for use across devices. | Users who want encrypted synchronization with a deliberate recovery-key plan. |
| Aegis Authenticator | Encrypted Android vault using AES-256-GCM, with automatic backups to a location you choose. | Your vault password or biometric unlock and your separately maintained backup. | Documentation reviewed supports Android; it is not a cross-platform app. | Imports from several authenticators and plaintext or encrypted export. | Android users who prefer local control and are willing to manage backup files themselves. |
Features and limits above reflect the vendors’ documentation available on October 13, 2026. App behavior and account policies can change, so check the current restore screen before relying on a backup.
Google Authenticator: the simplest choice with two recovery modes
Account sync
When you sign in to a Google Account, Google Authenticator can synchronize your codes. That makes a phone replacement less dependent on the old handset: install the app, sign in to the same Google Account and let the codes return. The trade-off is that your Google Account becomes part of the recovery path. Protect that account with a strong password, recovery methods and an additional verification option.
Local-only storage
You can use the app without signing in. In that mode, codes remain on the device and are unavailable on another phone until you transfer them. Local-only use reduces the number of online accounts holding a copy, but it increases your responsibility for a manual migration.
Manual QR transfer
Google documents an export-and-import process:
- On the old phone, open Google Authenticator and choose the option to transfer or export accounts.
- Select the accounts to export and display the generated QR code.
- On the new phone, choose the import or scan option and scan the QR code from the old phone.
- Test several services on the new phone before erasing the old device.
The QR method requires the old device to be working and unlocked. If it has been lost, destroyed or factory-reset, a local-only setup cannot be reconstructed from memory; use each service’s recovery codes or account-recovery process instead.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Privacy and lockout safeguards
The app includes a Privacy Screen option to hide codes until you authenticate locally. Google also advises enrolling in additional verification options. Keep the recovery codes issued by every service in a separate, protected location; an authenticator backup should not be your only way back in.
Microsoft Authenticator: useful ecosystem features, uneven restore coverage
What the backup restores
Microsoft’s support documentation distinguishes account types. Third-party one-time-password accounts are available after a supported restore. Work or school accounts, and Microsoft accounts that also use passwordless sign-in, may restore only the account name. You then have to sign in again and complete that service’s setup. Seeing an account listed after restoration does not prove that its usable secret or passwordless credential has returned.
Same-device-type limitation
Current Microsoft documentation says Authenticator backup restores only to the same device type. Treat an Android-to-iPhone or iPhone-to-Android move as a re-enrollment project, not as a guaranteed restore. Before switching platforms, sign in to each important service, generate fresh recovery codes and identify an alternate verification method.
Recommended Free Tools
Backup-method change scheduled for 2027
Microsoft says that beginning in January 2027, users will enable Authenticator backup through Google One rather than a Microsoft personal account. This is a dated policy change and should be rechecked in Microsoft’s current support instructions before publication or migration. Do not assume that a backup created under one method will have identical restore behavior after the change.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Push approvals and passkeys are different credentials
Microsoft Entra documentation describes notification-based passwordless sign-in and device-bound passkeys based on WebAuthn. Those features can reduce reliance on passwords, but they are not the same thing as restoring a generic TOTP secret. An organization may require a new registration even when third-party codes restore successfully.
Ente Auth: encrypted synchronization with a recovery-key obligation
How its sync model works
Ente describes its mobile, desktop and web apps as using end-to-end encrypted sync. Codes are encrypted on the device before synchronization, so the service is designed not to receive readable vault contents. Import and export let you move accounts or retain an independent copy.
Why the recovery key matters
The documented recovery model depends on credentials you control. Keep the recovery key somewhere separate from the phone and password manager you might lose at the same time. If you forget the password, the recovery key is needed to regain access; the service cannot simply recover readable codes without your credentials.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallNo-backup mode
Ente’s help material describes a no-backup mode in which codes stay on the device. That can suit someone who deliberately avoids cloud copies, but the documentation also advises making a separate backup and preserving it securely. A no-backup setting is not protection against phone loss unless you have a tested export.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Encrypted export
The documented encrypted export format derives a key from a password and uses XChaCha20-Poly1305. Choose a unique export password, store it in a secure password manager and verify that the file can be imported before deleting the source vault. A file that exists but cannot be decrypted is not a usable backup.
Aegis Authenticator: local Android control
Encrypted vault and unlock methods
Aegis is a free, open-source Android authenticator. Its vault is documented as using AES-256-GCM encryption and can be unlocked with a password or biometrics. Automatic backups can be written to a location you choose, allowing storage on local media or a service you already trust.
Manual responsibility
Local control also means local responsibility. Decide where the automatic backup resides, how it is protected from ransomware or accidental deletion and how you will retrieve it when the phone is gone. Periodically restore a copy to a spare or test device. A backup that has never been opened is only an assumption.
Import and export choices
Aegis can import from several authenticator apps and export either plaintext or encrypted data. Plaintext export is convenient for migration but exposes every secret to anyone who obtains the file. Use it only for a controlled transfer, delete temporary copies securely and prefer encrypted export for storage.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Choose by recovery scenario, not by logo
If you replace a phone on the same platform
Automatic sync is the least labor-intensive option. Google Authenticator’s account sync and Ente’s encrypted sync are designed for this situation; Microsoft Authenticator can work when the account type and device type meet its restore rules. Confirm that a restored code actually signs you in before wiping the old phone.
If you switch between Android and iPhone
Do not infer portability from the presence of a “backup” toggle. Microsoft documents same-device-type restore, and Google local-only storage requires a QR transfer from the old device. For a platform switch, export or transfer each account while both phones are available, then test the new codes. Ente’s multi-device apps and import/export may fit a cross-platform workflow, but you should still perform a test import rather than assume every account transfers identically.
If you want no cloud copy
Use a local-only mode or a locally managed encrypted vault, then create at least two protected copies of the export in separate locations. This approach minimizes provider dependence but makes you responsible for encryption passwords, storage media and recovery testing.
If you need work or school sign-in
Ask the administrator which methods are enabled. A work account can require a push approval, passkey or fresh registration even when its name appears after a restore. Keep the organization’s alternate sign-in instructions and emergency-access process outside the phone.
If you want passkeys or a physical security key
A FIDO2 security key is an adjacent option, not a universal replacement for an authenticator. It works only with services that support passkeys or security keys, and compatibility varies by account, browser and device. Google’s guidance presents security keys as another verification method; Microsoft documents Authenticator passkeys using WebAuthn. Keep an authenticator or other approved method for services that require TOTP.
A safe migration and backup procedure
- Inventory accounts. List every service in the old authenticator and label it personal, work, school or passwordless.
- Collect recovery material. Download fresh recovery codes and confirm an alternate method for each critical account before touching the old phone.
- Enable the chosen backup. Record the backup account, export password or recovery key in a separate secure location.
- Create an independent copy where appropriate. Export an encrypted file or make the app’s documented local backup. Do not leave the only copy on the phone being replaced.
- Restore or import on the new device. Follow the app’s current transfer screen and respect platform limitations.
- Test real sign-ins. Use a private browser window or another device to verify codes for several services, including at least one work or passwordless account if applicable.
- Keep both devices temporarily. Leave the old phone intact until every important account works and the backup has been opened successfully.
- Retire the old phone safely. Remove accounts, revoke sessions and factory-reset it only after verification is complete.
Common failure modes and fixes
- The restored list is present but codes fail: the account may have restored only its name, or the service may have been re-enrolled. Use recovery codes and set up the account again.
- You lost the old phone before exporting: local-only QR transfer is no longer possible. Work through each service’s recovery process; an app cannot recreate a secret it never backed up.
- A cross-platform restore is blocked: follow a per-account export or re-enrollment path. Same-device-type rules are hard limits, not settings to bypass.
- The backup password or recovery key is missing: stop deleting old devices. Search your protected records and generate new service recovery codes while access remains.
- A plaintext export was exposed: treat every contained secret as compromised, delete the file and reset two-factor authentication for the affected services.
- Codes are consistently rejected: check the phone’s automatic date and time, then confirm that the service and app are using the same account entry. If the problem persists, re-enroll using the service’s recovery method.
What the 2023 security study does—and does not—tell you
A 2023 USENIX Security Symposium study reported encrypted backups in 15 apps in the sample it analyzed and examined weaknesses in backup implementations. Those results apply to the apps and versions studied at that time; they are not a current audit or a ranking of the apps discussed here. The practical lesson is to inspect the recovery design, protect its keys and test restoration instead of treating the word “encrypted” as a complete guarantee.
A decision checklist
- Do I want automatic sync, a local vault or both an online and offline copy?
- What account, password, recovery key or old device would I need after a phone loss?
- Will I move between Android and iPhone?
- Which entries are third-party TOTP accounts, and which are work, school or passwordless accounts?
- Have I saved each service’s recovery codes outside the authenticator?
- Can I perform a test restore before deleting the old device?
- Does a security key or passkey help for the services I actually use?
For a straightforward same-platform setup, Google Authenticator is convenient if you are comfortable making a Google Account part of recovery; its local-only mode is better for users prepared to manage transfers themselves. Microsoft Authenticator is strongest when Microsoft push or Entra passkey features matter, but its restore exceptions and same-device-type rule require planning. Ente Auth suits readers who prioritize end-to-end encrypted, multi-device storage and can safeguard a recovery key. Aegis suits Android users who want an encrypted local vault and accept full responsibility for backup files. In every case, the safest choice is the one whose recovery process you have documented and successfully tested.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
