Open Source Authenticator Apps: Top Alternatives

Yes, you can ditch Google Authenticator for a gorgeous open-source alternative, and the best options are Aegis Authenticator (Android) and Raivo OTP (iOS). These apps offer modern interfaces, encrypted backups, and full control over your 2FA codes without locking you into Google’s ecosystem. This article explains what makes these apps better, how to switch safely, and what to watch out for.

Why People Are Leaving Google Authenticator

Google Authenticator has been the default two-factor authentication (2FA) app for over a decade, but it has several well-known shortcomings. The most cited problems are:

• No encrypted backup: If you lose your phone, you lose all your codes unless you manually transfer them one by one. Google added a cloud sync feature in 2023, but it requires a Google account and still lacks end-to-end encryption.
• No password protection: Anyone with access to your unlocked phone can open the app and see all your 2FA codes.
• Limited export options: Exporting codes is clunky, and the QR-code-based transfer only works between Google Authenticator instances.
• Dated interface: The app has changed little over the years, and many users find it visually unappealing compared to modern alternatives.

Open-source apps address these issues while adding features like biometric locks, encrypted cloud backups, and theme customization.

The Best Open-Source Alternatives

Two apps dominate the recommendation space, each targeting a different mobile platform:

• Aegis Authenticator (Android): Aegis is the most popular open-source 2FA app on Android. It offers AES-256 encryption for your vault, fingerprint or PIN unlock, and the ability to back up to Google Drive, Dropbox, or a local file. It also supports multiple themes, including a dark mode and a Material You design.
• Raivo OTP (iOS): Raivo is the go-to open-source choice for iPhone users. It supports Face ID/Touch ID, iCloud sync (with encryption), and a clean, minimalist interface. Raivo also allows you to export your codes as a JSON file or as QR codes for easy migration.

Both apps are available on their respective app stores (Aegis is also on F-Droid) and are completely free with no ads. They both support the standard TOTP (Time-based One-Time Password) and HOTP (HMAC-based One-Time Password) algorithms, so they work with any service that supports Google Authenticator.

How TOTP Works Under the Hood

To understand why these apps are compatible, you need to know how TOTP works. When you enable 2FA on a service, the service generates a secret key (a random string of characters). That secret is shared with your authenticator app, usually via a QR code. The app then combines that secret with the current time (in 30-second intervals) to generate a 6-digit code using the HMAC-SHA1 algorithm. Both the server and your app know the secret and the time, so they can independently compute the same code. This is why your phone doesn’t need an internet connection to generate codes.

Open-source apps implement this same standard, so they can read the same QR codes and produce the same codes. The only thing that differs is how the app stores and protects your secrets.

How to Switch Without Losing Access

Switching apps is straightforward if you follow these steps:

1. Install your new app (e.g., Aegis or Raivo) and set a master password or biometric lock.
2. Export codes from Google Authenticator: In Google Authenticator, go to Settings > Transfer accounts > Export accounts. You’ll be asked to verify your identity, then a QR code (or a series of QR codes) will appear on screen.
3. Import into the new app: In Aegis, tap the plus icon and choose “Import from Google Authenticator” (or scan the QR code). In Raivo, go to Settings > Import > QR Code and scan the codes.
4. Verify each account: After importing, test each account by generating a code and logging in with it. This confirms the secret was transferred correctly.
5. Delete the old app: Once you’re confident everything works, uninstall Google Authenticator.

If you have a lot of accounts, this process can take a few minutes, but it’s a one-time effort. Some services also let you disable and re-enable 2FA, which gives you a new secret and effectively resets the setup.

Security Features That Matter

Open-source apps often have security features that Google Authenticator lacks:

• Encrypted vault: Aegis and Raivo encrypt your secrets with a password (using AES-256). Even if someone steals your backup file, they can’t read it without the password.
• Auto-lock: You can set the app to lock after a period of inactivity, requiring your fingerprint or PIN to reopen.
• Clipboard clearing: When you copy a code, the app can automatically clear the clipboard after 30 seconds to prevent other apps from reading it.
• Screenshots disabled: Both apps prevent screenshots of the code list to reduce the risk of visual eavesdropping.

One common misconception is that open-source automatically means more secure. In practice, open-source allows security researchers to audit the code, but it doesn’t guarantee that no vulnerabilities exist. However, both Aegis and Raivo have been audited by the community and have no known major security issues.

Comparing Aegis vs. Raivo

If you’re on Android, Aegis is the clear winner. It has more features, including icon packs, folder organization, and the ability to export in multiple formats. If you’re on iOS, Raivo is your best bet, though it’s slightly less feature-rich. There is no cross-platform open-source app that works on both Android and iOS with the same level of polish, so your choice depends on your phone’s OS.

For users who want a cross-platform solution, consider Ente Authenticator (open-source) or 2FAS (also open-source), both of which offer apps for iOS and Android. Ente is known for its end-to-end encrypted cloud sync, while 2FAS has a browser extension companion. However, these have slightly different trade-offs in terms of backup and import options.

Backup Strategies: Don’t Lose Your Codes

The biggest risk with any authenticator app is losing your phone. Open-source apps give you better backup options, but you must set them up:

• Local encrypted backup: Aegis allows you to export an encrypted JSON file to your device or cloud storage. Raivo similarly offers an encrypted export.
• Cloud sync: Raivo can sync to iCloud (with encryption), and Aegis can sync to Google Drive or Dropbox if you set it up. Ente offers its own cloud sync with end-to-end encryption.
• Print recovery codes: Most services give you recovery codes when you enable 2FA. Store these in a safe place (like a password manager or a physical safe) as a last resort.

Remember: if you lose your phone and have no backup, you will be locked out of any service that requires 2FA. This is a serious risk, so take backups seriously.

Frequently Asked Questions

Is it safe to use an open-source authenticator app?

Yes, for most users. Open-source apps like Aegis and Raivo have been reviewed by security experts and have no known backdoors. They also offer encryption and biometric locks, which are more secure than Google Authenticator’s default settings. However, always download from official app stores or the project’s GitHub page to avoid tampered versions.

Will these apps work with all my accounts that use Google Authenticator?

Yes, as long as the service uses standard TOTP (which is almost universal). Some services (like Microsoft or Blizzard) use their own proprietary 2FA, but those are separate apps anyway. If a service shows a QR code or a 16-character secret key, it will work with any TOTP app.

Can I have the same codes on two phones?

Yes, you can. You can either scan the same QR code into both apps (if the service allows it) or export your secrets from one app and import into the other. However, having the same secret on multiple devices reduces security slightly, as there are more attack surfaces. It’s better to use a single device and keep a backup.

What happens if I lose my phone after switching?

If you set up an encrypted backup, you can restore your codes on a new phone by importing the backup file and entering your password. If you didn’t set up a backup, you’ll need to use the recovery codes you saved when you enabled 2FA on each service. Without either, you may be locked out permanently.

Do these apps show ads or collect my data?

No. Both Aegis and Raivo are completely free and open-source, with no ads and no analytics. They don’t collect any personal data. The only data they handle is your 2FA secrets, which are stored locally and encrypted.

Can I use an open-source authenticator on a computer?

Yes, but it’s less common. There are desktop apps like KeePassXC (which supports TOTP) and browser extensions like Authenticator for Chrome. However, using 2FA on a computer is generally less secure than on a phone, as computers are more likely to have malware. For high-value accounts, stick to your phone.

Related

• 1990s IT Backup: The Accidental Music Format
• RHEL Packet Filtering NAT & Kernel Parameters
• QR Code Creator’s No-Patent Choice: Why It Won