SMS-based two-factor authentication has been quietly retired by the security community for years; the FBI’s 2024 advisory and NIST’s 2025 SP 800-63 update both formally discourage it because of SIM-swap attacks. The replacement is an authenticator app generating Time-based One-Time Passwords (TOTP) or, increasingly, syncing passkeys. The market has settled around five solid choices, each optimized for a different threat model and convenience trade-off. After running all five across iOS, Android, and desktop for 90 days, here is the hands-on comparison.

Phone showing 2FA code

At a Glance

AppBest ForBackupCost
Aegis AuthenticatorPrivacy-first Android usersEncrypted local exportFree, open source
AuthyConvenience across devicesCloud syncFree
2FASCross-platform with iCloud synciCloud + Google DriveFree, open source
Microsoft AuthenticatorMicrosoft 365 organizationsCloud sync (Microsoft account)Free
1Password TOTPAnyone already in 1PasswordEncrypted vault syncBundled with 1Password

Aegis Authenticator — Best for Privacy-First Android

Aegis is the open-source standard among Android security professionals. The app is local-first: codes never leave the device, exports are encrypted with a passphrase you choose, and the source code has been audited multiple times. It is the only choice if your threat model includes “the authenticator app provider could be compromised.”

Strengths:

  • 100% on-device, no cloud component
  • Encrypted backup file you control
  • Biometric unlock + per-entry icons
  • Active GitHub project, frequent updates

Drawbacks: Android only. iOS users need an alternative. Manual backup discipline required — losing the phone without a recent backup means recreating every TOTP secret.

Authy — Best for Convenience Across Devices

Authy popularized cloud-synced authenticator apps. The convenience is real: install on phone + tablet + desktop, codes appear everywhere instantly. The trade-off is trust in Twilio (the parent) and the slightly higher attack surface that comes with cloud sync.

Strengths:

  • Multi-device sync with PIN protection
  • Desktop apps (Windows, macOS, Linux)
  • Migration helper from other apps
  • Solid for users who reset phones often

Drawbacks: Cloud sync is the convenience and the risk. Twilio Authy backups are encrypted, but you must trust the implementation. The desktop app was deprecated in late 2024 and is being phased out — confirm current platform support before relying on it.

2FAS — Best Cross-Platform Open Source

2FAS Auth is the open-source app most commonly recommended for users who want both Aegis-style transparency and iOS support. It runs on iOS and Android, encrypts backups to iCloud or Google Drive, and supports browser extension code retrieval.

Strengths:

  • Open source on both iOS and Android
  • iCloud / Google Drive encrypted backup
  • Browser extension for desktop code paste
  • Active development, transparent security disclosures

Drawbacks: The browser extension’s UX is a step behind 1Password’s, and there is no native desktop app.

Microsoft Authenticator — Best for Microsoft 365 Organizations

If your work life lives in Microsoft 365, the Microsoft Authenticator integration is excellent. Push-notification approvals for Azure AD logins skip the manual code entry entirely, and number-matching defends against MFA fatigue attacks.

Strengths:

  • One-tap approvals for Microsoft 365 / Entra ID
  • Number-matching prevents MFA fatigue attacks
  • Free with cloud backup tied to Microsoft account
  • Passkey support added in 2025

Drawbacks: Best inside the Microsoft ecosystem. Outside it, the app is competent but unremarkable.

1Password TOTP — Best Bundled Option

If you already pay for 1Password, its built-in TOTP storage is the path of least resistance: codes live next to the credentials they protect, autofill across devices, and the encrypted vault you already trust handles backup.

Strengths:

  • Codes stored beside the matching credential
  • Cross-device sync via your existing 1Password vault
  • One subscription handles passwords + 2FA + passkeys
  • Strong family plan ($60/year for 5 users) often pairs with Best Password Managers for Families 2026

Drawbacks: Putting passwords and TOTP in the same vault means a single compromise reveals both. Security purists prefer separating them; most pragmatists accept the trade-off.

Decision Matrix — Pick Your App in 60 Seconds

Your ProfileBest Pick
Privacy maximalist on AndroidAegis
iOS user wanting open source2FAS
Multi-device convenience seekerAuthy or 1Password TOTP
Microsoft 365 employeeMicrosoft Authenticator
Already pay for 1Password1Password TOTP

Migration Tips

Three rules that have prevented the most common migration disasters:

  1. Migrate one account per session, not the whole list. Verify the new app generates a working code, log out and back in once, then move to the next account.
  2. Keep the old app installed for 30 days. Most account recovery edge cases surface within a month.
  3. Print one paper backup of your 5 most critical recovery codes. Store in a fireproof location. This is your last-resort recovery.

Hardware Key as a Backup Layer

For high-value accounts (primary email, password manager, financial accounts), pair an authenticator app with a hardware security key. The pairing — TOTP for daily convenience, hardware key as the second factor for critical actions — is the gold standard. Detail in Hardware Security Keys Guide.

Bottom Line

For most readers in 2026 the right pick is 2FAS (open source, cross-platform, encrypted backups) or 1Password TOTP (zero extra cost if you already subscribe). Aegis is the choice for Android privacy maximalists. Authy still works but the desktop deprecation makes it a less future-proof bet. Microsoft Authenticator is the obvious default inside the Microsoft 365 ecosystem.

Sources

  • NIST SP 800-63B-4 Digital Identity Guidelines, 2025 update
  • FBI IC3 Public Service Announcement on SIM-swap, 2024
  • Aegis Authenticator GitHub repository, accessed May 2026
  • 2FAS Auth Privacy Policy, 2026
  • Microsoft Entra ID number-matching announcement, 2024