Private Authenticator Apps 2026

The authenticator rating rubric

Every authenticator app is scored out of 10 against five weighted categories. Who can read the secrets behind your codes carries the most weight, and a synced backup is not counted as a plus on its own.

• Secret Custody & Recovery — 30%

  Who can read the secrets behind your codes, whether a backup exists, where it goes, whether it is on by default and whose key protects it, how the secrets are protected on the phone, and what happens when the phone is lost. An app where the vendor can read the secrets cannot score high here.

• Account & Metadata Privacy — 20%

  Whether the app works without an account, what it asks for (an email address, a phone number), and what it reports about you through telemetry.

• Transparency & Verifiability — 20%

  Whether the code is open, whether builds can be reproduced, whether an independent audit exists and who paid for it, a bug bounty, and past incidents.

• Usability, Portability & Platforms — 20%

  Whether you can take your codes with you (export formats, import from other apps), whether one set of codes works on several devices, which platforms and code types are covered, and how well the app works day to day.

• Funding & Sustainability — 10%

  Who pays for development, whether the app is likely to be maintained, and whether the price, where there is one, is clear. Most authenticators are free, so price alone does not separate them.