Authy, Aegis, Google/MS Authenticator, AndOTP, Bitwarden - What do you use for 2FA OTP?

YKM · December 2021

MS Authenticator since I tried to move google Authenticator and had to redo the lot

Setsura · December 2021

I'm using authy due to it being easy and syncing between my multiple devices which I do actually have and use. I'm thinking about switching to bitwarden self-hosted or perhaps paid instead though due to authy not allowing easy export of your codes as well as being closed source. I'm not in any huge hurry though.

Maurice · December 2021

AndOTP and Bitwarden/Vaultwarden mixed with a few security keys. Not a fan of having "the cloud" store my 2FA secrets.

cpsd · December 2021

Authy as main generator and Google as backup.

Logano · December 2021

Um.. am I missing something? You guys go with a single authenticator? How?
I thought different sites required different apps?

Sova · December 2021

Authy user here as well. Thanks to this thread I found out they have a desktop app as well! Wooohooo!

polz · December 2021

bitwarden vaultwarden (self hosted)
2 fa authy because using multi device ios and android

M66B · December 2021

FreeOTP should be mentioned as alternative for Authy:

https://f-droid.org/en/packages/org.fedorahosted.freeotp/

smile93 · December 2021

@allthemtings said:
Always used google Auth but stopped since you couldn’t easily transfer to a new device then switched to Authy, now you can import to google Auth I now use both 🤣

You can always export (backup) it using QRcode. Then you can have the same GAuth running at multi-devices.

louiejordan · December 2021

Authy or Bitwarden

cochon · December 2021

@Logano said:
Um.. am I missing something? You guys go with a single authenticator? How?
I thought different sites required different apps?

If the site requests a 6 digit TOTP code, then all the apps are interchangeable, it's a standard algorithm

A very few sites may require a proprietary method.

Ympker · December 2021

Installed Authy and very happy how easy it was to setup & sync on my phone and desktop
Thanks for the recommendation!

Logano · December 2021

@cochon said:

If the site requests a 6 digit TOTP code, then all the apps are interchangeable, it's a standard algorithm

A very few sites may require a proprietary method.

Sweet, thanks! I already had Authy for Twitch, so might as well transfer over my Google Auth stuff.

ascicode · December 2021

@M66B said:
FreeOTP should be mentioned as alternative for Authy:

https://f-droid.org/en/packages/org.fedorahosted.freeotp/

6y no updates.

M66B · December 2021

@ascicode said:

@M66B said:
FreeOTP should be mentioned as alternative for Authy:

https://f-droid.org/en/packages/org.fedorahosted.freeotp/

6y no updates.

Works fine.

mikrocybercloud · October 4

Whats recommendation in 2026 end
Saw many comments for Authy

CloudHopper · October 4

Aegis. I like the fact that the app has a password you need to enter before being able to access the OTP codes as an extra layer of security.

budi1413 · October 4

@mikrocybercloud said:
Whats recommendation in 2026 end
Saw many comments for Authy

me using ente

ascicode · October 4

After authy got hacked, i switched to 2FAS Auth.

remy · October 4

Quite old post but still relevant
I'm using self hosted vaultwarden as password manager and 2FA
And official bitwarden clients (mobile / desktop browsers)

marl · October 4

google

Motion3549 · October 4

Ente

nick_ · October 5

KeepassXC, Keepass2Android, and Dropbox for syncing DB automatically.

vuanhson · October 5

Bitwarden + 2FAS. After Lastpass incident, I hate some 2FA app don't allow me to export the seed to get out of their platform, so I choose 2FAS.

amsaal · October 5

Proton Pass

GreenLeafwebNet · October 5

Ive been using Authy for years. Lately, i've been using it with the OTP Manager plugin on Nextcloud.

nikio · October 5

I don't know why everyone is complaining about Google Authenticator and migration - the four or five times I have had to migrate it, it worked seamlessly with no issues. This was true as far back as 2018 so not a new feature. You just needed to have two devices ready: the old device with existing codes and the new device to which you want to migrate. Scan one QR code from the new device and it all works perfectly.
If you care about privacy you should probably stop using Google Authenticator because now it is tied into the rest of the Google Accounts enabled on your device (even IOS) so Google is probably storing all your MFA codes that they say they don't store pinky promise.
Realistically speaking, though, considering the number of people simping for Authy in this thread (and other "cross-platform" features), most people probably don't care about privacy nor security.
The whole point of 2FA is to be a second factor, a 'something you have' as opposed to a 'something you know'. Your password is something you 'know' (even if indirectly, because you don't know the password but you know the master password to your password manager). Saving 2FA codes to the same password manager defeats the point of 2FA. However, running 2FA codes in a separate app but on the same physical system as your password manager similarly defeats the point. Now your entire authentication is just a 'something you have' but with extra steps.
If you care about code security at least require your device passcode to unlock your authenticator app of choice on your mobile device. Don't use FaceID / fingerprints.
A 2FA app for desktop is exceedingly dumb. Your desktop is the highest risk for malware anyway. Accessing 2FA codes from your desktop not only defeats the point of 2FA at a policy level, but also means that whatever malware you're trying to mitigate is just going to have direct access to your second level of authentication.
Yubikeys got pwned recently. Firmware cannot be upgraded. If you want to rely on hardware tokens make sure you get the new and patched keys.
Don't use any cloud provider ever. I don't care if it is Bitwarden cloud, just don't. Remember how Microsoft leaks your bitlocker keys to the feds. Do you really think they won't leak your 2FA codes as well? Honestly a post-it note with the seed phrase taped to your screen is going to be more secure than trusting Microsoft?