2FAS Auth is a free authenticator app for Android and iPhone, made by Two Factor Authentication Service, Inc., a US company that has been building it since 2015. It generates the six-digit TOTP codes that many sites ask for as a second step at sign-in, and a browser extension can fill those codes in on your computer.

The app has no account, and 2FAS says the secrets behind your codes stay on your phone and never reach its servers. That is 2FAS’s own statement; no published audit checks it. The optional backup goes to your own Google Drive or iCloud, and whether that copy is encrypted depends on your phone and on whether you set a backup password.

Where the Secrets Live

The secrets are stored on the phone, and the app’s licence agreement says 2FAS cannot recover them if they are lost. On Android the app’s database is encrypted with a random key that the phone’s keystore protects. On iPhone, according to the app’s public source code, the app’s own encryption of stored secrets uses a key built into the app, so what protects them there is the phone itself and its passcode.

You can add a PIN of 4 or 6 digits or a fingerprint or face lock to the app. On Android, without a PIN the app does not let you reveal a stored secret, and home-screen widgets, if you turn them on, show codes without asking for the PIN.

The Cloud Backup

The backup is off until you turn it on, and the Android app reminds you on its home screen. It goes to the cloud account you already use, not to 2FAS: a hidden folder of Google Drive on Android, iCloud on iPhone. Only the 2FAS app can open that folder through Google’s interface. The same backup keeps several phones in sync.

On Android, the copy is not encrypted by the app unless you set a backup password in the backup settings. Without one, the secrets sit in your Google Drive as readable text: Google, which stores the file, can read it, and so can anyone who gets into your Google account. With a password, the app encrypts the copy before uploading it.

On iPhone, the app encrypts the copy even without a password, with a random key it keeps in your iCloud Keychain. Apple says iCloud Keychain is end-to-end encrypted, so Apple cannot read that key, but anyone who controls one of your trusted Apple devices can. Since version 5.4.0 you can set your own backup password instead.

A backup password has a cost: 2FAS cannot reset it. If you forget it, the existing backup cannot be opened, and the only way forward is to delete it and start a new one from the phone that still has the codes.

Losing Your Phone

With the cloud backup on, you restore the codes on a new phone by signing in to the same Google or Apple account, plus the backup password if you set one. With the backup off and no exported file, losing the phone means losing every code, and you will have to recover access at each site separately, usually through that site’s own recovery process. The app warns about this itself when you try to reset it.

Moving Your Codes

You can export all codes to a file with the .2fas extension, protected by a password or, if you choose, without one. The file uses 2FAS’s own layout rather than a standard format, though the layout is readable in the public source code. You can also reveal or copy the secret of a single code once the app has a PIN. Importing works from 2FAS files, from a file of standard codes and from a list of other authenticator and password apps.

The app supports TOTP and counter-based HOTP codes, the Steam variant, and the SHA-1, SHA-256 and SHA-512 algorithms.

The Browser Extension

The extension for Chrome, Firefox, Edge, Safari, Brave and Opera does not hold your secrets. When a site asks for a code, the extension sends a request to your paired phone, you approve it there, and the phone sends back that one code. The code travels through 2FAS’s server encrypted with a key that only the extension has, and 2FAS says it cannot decrypt it.

What 2FAS Collects

2FAS has no user accounts. Its privacy policy says it collects anonymous technical data, including crash reports through Firebase Crashlytics, and installation data for the extension, and no usage analytics or advertising data. Crash reports are switched on by default and can be turned off in the app’s settings; the App Store listing names crash data as the only data collected, not linked to you. Debug logs reach 2FAS only when you send them to support. This counts as telemetry you have to opt out of.

Open Source and Audits

The code for the iPhone app, the Android app, the browser extension and the server sits in public repositories with a GPL v3 licence file. In the Android repository, 107 of about 590 code files are marked as under the Business Source License 1.1, a source-available licence that is not open source. In the iPhone repository, several files, including the one holding the app’s built-in keys and its service catalogue, are kept encrypted, so the public code alone does not show everything that goes into the store app.

2FAS does not publish a security audit of the app, and the claim that it never sees your secrets rests on its word and on code you would have to read yourself. There is no bug bounty; 2FAS runs a security email address with a 72-hour response promise. Its GitHub repositories list no published security advisories.

Company and Funding

Two Factor Authentication Service, Inc. gives an address in Henderson, Nevada, and the app’s licence agreement is governed by Delaware law. The team works fully remotely. The app is free, with no ads and no paid features; 2FAS takes donations and also sells a yearly plan of its separate password manager, 2FAS Pass.

Pros and Cons

No account, and 2FAS has no copy of your secrets
Backup goes to your own Google Drive or iCloud, not to 2FAS
The iPhone backup is encrypted with a key in your iCloud Keychain even without a password
Exports every code to a file, with a password if you choose
Imports from many other apps and from a file of standard codes
Browser extension fills codes in without holding the secrets
Free, with no ads and no paid plan

On Android the Google Drive backup is not encrypted unless you set a backup password
On iPhone the app's own encryption of stored secrets uses a key built into the app
No published audit and no bug bounty
Part of the Android code is under a source-available licence, and some iPhone files are kept encrypted
Crash reports to Firebase are on by default
The export file uses 2FAS's own layout, and there is no desktop app

Our Rating

2FAS suits people who want a free authenticator without an account, with a backup in a cloud they already use and codes filled in on their computer. Android users should set a backup password when they turn the backup on. It does not suit anyone who needs an audited app or a desktop app.

Secret Custody & Recovery7.0/10
2FAS keeps the secrets on your phone and has no copy of them, and the backup goes to your own Google Drive or iCloud. On iPhone that copy is encrypted by the app even without a password. On Android it is not encrypted unless you set a backup password, and the backup is off until you turn it on.
Account & Metadata Privacy8.0/10
The app has no account and works without one; the optional backup uses the Google or Apple account you already have. Crash reports go to Firebase and are on by default, with a switch in the settings, and the browser extension is paired through 2FAS's server.
Transparency & Verifiability5.5/10
The iPhone app, the browser extension and the server are public under GPL v3. Part of the Android code is under a source-available licence, and several iPhone files are kept encrypted in the public repository. There is no published audit and no bug bounty, only a security contact.
Usability, Portability & Platforms8.0/10
You can export every code to a file, with or without a password, and import from many other apps. The app covers Android, iPhone, iPad and Apple Watch, syncs between phones through your cloud, and fills codes into the browser through an extension. The export file uses 2FAS's own layout, and there is no desktop app.
Funding & Sustainability7.0/10
The app is free with no ads and no paid plan. Development is paid for by donations and by the company's separate password manager, which has a yearly plan, and the company has been making the app since 2015.

Overall7.1/10

Secret Custody & Recovery 30% · Account & Metadata Privacy 20% · Transparency & Verifiability 20% · Usability, Portability & Platforms 20% · Funding & Sustainability 10%

See our rating methodology →