Authy

Compared with other systems, I give Authy the nod because it supports both mobile apps **and** Windows. Linux support would be nice, but there's always WINE for that.

The major benefit I see of Authy over Google/Microsoft authenticator is the ability to clone the data to multiple targets, and then turn off the sharing once it's been cloned. In other words, I've got a clone of Authy on my desktop and tablet at home, so if my phone gets stolen or lost, I can still get into all of my accounts to change the passwords and reset 2FA. And when I replace my phone in a few years, I don't have to reset every single one of my accounts like I would have to with Google Authenticator.

I suspect that other authenticators will catch up in terms of convenience, but at the moment, Authy has them beat in terms of ease of use. The fact that the biggest complaint people have about Authy is that they wish it had more web site icons shows that there really aren't a lot of major issues to complain about.

Update 2023-08-23: All of the above remains true, and Authy is still recommended, but two things have changed since my initial review.

First, Authy was hacked in 2022. Under 100 accounts were affected, and Twilio/Authy took immediate action to change the default behaviour so that multi-device is disabled by default now. Because it's a no trust system, it didn't actually expose any customer codes, which is good, but it's still a black mark against them.

Second, there have been a number of privacy concerns about how much data Authy collects when you use it. Authy is logging things like your usage patterns, the IP address and geo-location of your device, and the date and time you generated 2FA tokens, for which sites, and things like that.

I still use Authy on my Windows PC, with a firewall rule set to disable it from talking to the internet. For sites which I need on my mobile device, I use and recommend Aegis Authenticator. However, Aegis requires you to do your own backups and the like, so Authy remains a better choice for less technical users.

tldr version - If you're comfortable with doing your own JSON backups, Aegis might be a better choice. If you don't know what JSON is, Authy is probably a better choice. Both are secure; the difference is that Aegis gives you more control and privacy, at the cost of a bit more complexity.

Just received an email from Authy, they are discontinuing the desktop apps for March 2024..

I just lost any reason to use their app, it was convenient to have my 2FAs setup with one account that I could access at any moment on either a mobile device or a computer, now they are forcing me to use my phone.

That was the whole point of using your service in the first place !!

I'm going to switch to some other service / app (probably Open-source and easy to export, for obvious reasons) Unfortunately, so far I didn't find any replacement for both mobile / desktop.

I recommend 2FAS on Android / iOS if you are looking for a mobile device only replacement