Short answer: For most iPhone users, 2FAS is the best free choice — open source, automatic iCloud backup, no account required, and a browser extension for desktop logins. Ente Auth is the best option if you want end-to-end encrypted sync across platforms. 1Password or Bitwarden make sense if you already pay for a password manager. Apple’s built-in verification codes in iCloud Keychain are fine for low-risk accounts and cost nothing extra.
What actually matters when choosing
Every authenticator generates the same six digits from the same algorithm — that part is settled, and it is why any app works with any site. What separates them is everything around the codes:
- Backup and recovery. The overwhelming way people lose access is a lost or broken phone, not a hacker. An app without a working backup story is a liability.
- Export. Can you get your tokens out and move to something else? If not, you are locked in.
- Desktop access. If you sign into things on a Mac all day, reaching for your phone forty times a day gets old.
- Encryption at rest. Is the vault protected beyond the phone’s own lock screen?
- Trust. Open source and audited, or at least a company with a business model that is not your data.
1. 2FAS — best overall free app
Open source, free, no ads, no account required. It backs up to iCloud automatically, which quietly solves the biggest real-world problem. Its browser extension pairs with the phone once, then sends an approval prompt when a site needs a code — faster than typing, and the secret never lands on your computer.
Strengths: automatic iCloud backup, cross-platform with Android, browser extensions for all major browsers, clean widgets, straightforward export.
Weaknesses: the browser extension relies on your phone being reachable; fewer power-user options than some rivals.
Full comparison against its main open-source rival in Aegis vs 2FAS.
2. Ente Auth — best encrypted sync
End-to-end encrypted sync across iOS, Android, desktop and web, from the team behind Ente Photos. Open source and independently audited. Your codes follow you everywhere without any provider being able to read them.
Strengths: genuine E2E sync, works offline, imports from most apps, free tier covers authenticator use, excellent for anyone with both an iPhone and a work Android.
Weaknesses: requires an Ente account; smaller ecosystem than the big names.
3. Raivo OTP — best minimalist option
A fast, native, no-nonsense iOS authenticator with iCloud sync and a macOS companion. It does one thing and gets out of the way.
Strengths: very fast, native feel, offline export to encrypted archives, macOS app.
Weaknesses: development pace has been uneven since its acquisition — worth checking recent update history before committing your whole token set. Keep an export.
4. Microsoft Authenticator — best for work accounts
If your employer runs Microsoft 365, this is likely already mandated. It handles standard TOTP for personal accounts alongside push approvals with number matching for work ones, plus passwordless sign-in for Microsoft accounts.
Strengths: encrypted iCloud backup, number-matching push (which defeats prompt bombing), free, enterprise-grade.
Weaknesses: heavier than it needs to be for personal use; backup is tied to a Microsoft account. Compared head-to-head in Microsoft Authenticator vs Google Authenticator.
5. 1Password / Bitwarden / Proton Pass — best if you already pay
Password managers with built-in TOTP autofill both factors in one action. The convenience is real and the backup problem disappears entirely.
The trade-off is equally real: both factors now live behind one master password. For most people this is still a net security win, because the alternative they would otherwise choose is reusing passwords. For your bank, your email and your crypto accounts, keep the codes in a separate app. The full argument is in password managers with built-in TOTP.
6. Authy — capable, but check the platform
Long the default recommendation for its multi-device sync and encrypted backups. Twilio discontinued the desktop apps, and its export story has always been the weak point — getting tokens out is deliberately difficult.
Still a solid mobile app with a mature backup system. Just know what you are signing up for. See Authy vs Google Authenticator.
7. Google Authenticator — fine, but no longer the obvious pick
It now syncs to your Google account, which fixed its worst flaw. But it is closed source, has no vault password of its own, and ties your second factor to the same Google account you are often protecting with it.
It works, it is simple, and its export QR feature makes leaving easy. If you want alternatives, we ranked the field in 7 best Google Authenticator alternatives.
What about Apple’s built-in verification codes?
iOS can store TOTP codes directly in iCloud Keychain: Settings → Apps → Passwords → [site] → Set Up Verification Code. They autofill in Safari, sync across your Apple devices, and cost nothing.
Good for: shopping sites, forums, low-risk services, and anyone who will never install an authenticator app.
Not ideal for: your Apple Account itself (which uses its own system), or high-value accounts — because the password and the code then sit in the same vault, protected by the same device passcode. It is the same trade-off as a password manager, without the option of separating anything.
How to choose in ten seconds
- Want free, simple, backed up: 2FAS.
- Use both iPhone and Android: Ente Auth or 2FAS.
- Already pay for a password manager: use it — but keep email, bank and crypto codes elsewhere.
- Work account on Microsoft 365: Microsoft Authenticator, and use it for everything.
- Want the strongest security available: a hardware key or passkeys where offered, with an app for everything else.
Frequently asked questions
Do I have to use the same app the website recommends?
No. When a site says “use Google Authenticator”, it means “use any TOTP app”. They are interchangeable — see how TOTP codes work. Steam is the notable exception, with its own Steam Guard system.
Can I switch apps without disabling 2FA on every site?
Sometimes. Google Authenticator exports via QR, 2FAS and Aegis produce encrypted export files, and Ente imports from most formats. Where export is not possible, you must disable and re-enable 2FA on each account — one reason to weigh export support before choosing.
Is it safe to keep all my codes in one app?
Yes, provided the app is reputable and you have a backup. The bigger risk is not concentration but loss — one app with a working backup beats codes scattered across three apps with none.
What happens to my codes when I get a new iPhone?
Apps with iCloud backup (2FAS, Microsoft Authenticator, Raivo) restore automatically. Apps with their own sync (Ente, Authy) restore after you sign in. Otherwise you need an export file — or you re-enrol every account manually. Our guide on moving Google Authenticator to a new phone covers that migration.
Are free authenticator apps safe?
The good ones are, and several are open source and audited. Avoid apps with ads, apps that demand unnecessary permissions, and anything with a generic name and few reviews — fake authenticators exist and their purpose is to capture your secrets.
Should I use two apps for redundancy?
For critical accounts, yes — scan the same setup QR into two apps while it is on screen. Both then generate identical codes forever, independently. It is the simplest backup there is, and it only works at setup time. See entering a setup key manually.
The bottom line
2FAS for most people, Ente Auth if you live across platforms, your password manager if you already pay for one and keep the crown-jewel accounts separate. Whatever you pick, confirm the backup works the same day you install it — the phone in the bottom of a swimming pool is a far likelier threat than any hacker.
Need a code right now without installing anything? Our browser-based 2FA code generator runs locally, and we explain when that is and isn’t appropriate in is an online 2FA code generator safe?
One Response