Aegis Authenticator is a free, open-source app for Android that generates the one-time codes used for two-factor authentication. It is made by Beem Development, a small team funded by donations, and is available on Google Play, F-Droid and GitHub.

The app has no account, no servers and no permission to use the internet. Your secrets stay in one file on your phone, and backing that file up is your job. That keeps the app off the network, and it also means nobody can restore your codes for you.

Where Your Secrets Live

Each service you add gives the app a secret from which it calculates the TOTP codes. Aegis keeps these secrets in a single vault file on the phone. The project’s own design document says the vault is encrypted with AES-256 under a random master key, which your password (through scrypt) unlocks, and that a fingerprint or face unlock uses a second key held in Android’s keystore. Anyone who unlocks either way gets the whole vault, so the vault is only as strong as the weaker of the two.

The first-run setup offers three choices: a password, which is pre-selected, biometrics, or no protection at all. Choosing no password leaves the secrets unencrypted on the phone, and the app marks that option as not recommended. If you forget the password, the developers say the contents of the vault are lost.

The app does not ask for the internet permission, so it cannot send your secrets anywhere by itself. That is a property of the code anyone can read, and no outside firm has audited it.

Backups and a Lost Phone

Automatic backups are off when you install the app. Once you switch them on and choose a folder, Aegis writes a new copy of the vault there after every change. The folder can sit on the phone, or on a cloud storage app that fully supports Android’s file picker; the developers name few that do, and another option is a separate sync app for a local folder. You can also let Android’s own cloud backup include the vault. Both options work only with a password-protected vault, but Android’s direct phone-to-phone transfer always includes the vault, unencrypted if you chose no password. A backup copy opens with your vault password or, if you set one, a separate password just for backups and exports. After a change that no backup covers, the app shows a bar saying that your changes are not backed up.

A backup that sits only on the phone is lost with the phone. If you lose the phone and have no backup file elsewhere, you will have to recover access at each service separately, using its own recovery codes or support process. If you keep the backup in a cloud folder, the cloud provider stores it, but without your password it sees only the encrypted file.

Moving Your Codes

Aegis lets you take every code with you. Its own file format can be exported encrypted or in plain text, and the same codes can be saved as a web page with QR codes or as a text file of the standard links that most authenticator apps accept. Only the app’s own file can be encrypted; the web page and the text file are plain, and the app asks you to confirm before saving any unencrypted copy. A separate screen shows QR codes that another app can scan, only for standard six-digit codes. The app also reads the export files of a long list of other authenticator apps, though for some of them the app needs root access on the phone.

Apps and Code Types

Aegis runs only on Android, and the developers say they have no plans for iPhone, desktop or a browser extension. There is no sync, so you cannot use the same set of codes on two devices at once except by copying the vault file yourself.

It supports time-based and counter-based codes with SHA-1, SHA-256 and SHA-512, plus Steam codes and two less common formats. Entries can be grouped, searched and given icons, codes can stay hidden until you tap them, and screenshots of the app are blocked.

Open Source and Audits

The whole app is public on GitHub under the GPL v3 licence, along with a detailed description of the vault format and a script that decrypts a vault with its password. There is no server code to publish because there are no servers. The APKs on Google Play and GitHub are signed with the same key, and the README lists its fingerprint. F-Droid builds and signs its own copy from the source; the project does not offer reproducible builds that would let you check a downloaded app against the code.

Aegis has never had a published security audit, and there is no bug bounty. That is a gap, and for a donation-funded project without a company paying for one it is no surprise. It means the encryption design has been checked only by people who chose to read the code.

Incidents and Vulnerabilities

The project’s incident history has one published advisory. On 6 September 2026 the developers disclosed that a specially crafted icon pack could overwrite the app’s internal files, including the vault file, if a user imported it. The attack needed someone to talk the user into importing a pack from an untrusted source, and the advisory rates it high severity for damage to the vault, with no impact on the secrets’ confidentiality. Versions from 2.0 onward were affected, and version 3.4.3, released the same day, fixed it. An outside reporter reported the flaw.

Ownership and Funding

Beem Development is the name on the store listings, and the Google Play listing gives a contact address in Dordrecht, the Netherlands. Most of the code comes from two developers. The app is free, has no ads or paid tier, and the project asks for donations instead. The repository has been on GitHub since 2016 and the latest release came out in September 2026. With so few core developers, the app’s future depends on them staying involved; because the code is open and the vault format documented, your codes do not depend on it.

Pros and Cons

No account, no servers and no internet permission
Vault protected by your own password by default, with a documented design
Every code can leave the app as an encrypted file, a plain file, standard links or QR codes
Imports the export files of many other authenticator apps
Open source under GPL v3, free, with no ads

Android only, with no iPhone or desktop app and no sync between devices
Automatic backups are off until you switch them on
No security audit, no bug bounty and no reproducible builds
In September 2026 a malicious icon pack could overwrite the vault file once imported (fixed in version 3.4.3)
A forgotten password means losing the vault

Our Rating

Aegis suits Android users who want their codes kept on the phone, with no account and nothing sent to a company, and who are willing to set up and look after their own backup. It does not suit anyone who needs the same codes on an iPhone or a computer, or who wants a provider to restore the codes after a lost phone.

Secret Custody & Recovery8.5/10
The secrets stay in a vault file on your phone, the app has no internet access, and setup offers a password by default. Backups can only be made of a password-protected vault and open only with your password or a separate backup password. Automatic backups are off until you switch them on, so a lost phone without a backup file means recovering each account at its own service.
Account & Metadata Privacy10.0/10
There is no account, no sign-up and no internet permission, so the app cannot send anything over the internet itself, and the store listing declares no data collected.
Transparency & Verifiability7.0/10
The app's code is public under GPL v3 and the vault format and encryption are documented in detail. There is no audit, no bug bounty and no reproducible builds. In September 2026 the developers fixed a flaw that let a malicious icon pack overwrite the vault file once a user imported it.
Usability, Portability & Platforms7.0/10
You can export every code as an encrypted file, a plain file, a list of standard links or QR codes, and import from many other apps. The app runs only on Android, with no iPhone or desktop version and no way to use the same codes on two devices at once.
Funding & Sustainability6.5/10
The app is free, without ads or a paid tier, and is paid for by donations. Most of the work comes from two developers; the project has been on GitHub since 2016 and had its last release in September 2026.

Overall8.0/10

Secret Custody & Recovery 30% · Account & Metadata Privacy 20% · Transparency & Verifiability 20% · Usability, Portability & Platforms 20% · Funding & Sustainability 10%

See our rating methodology →