Authy is a free two-factor authentication app for Android, iPhone, iPad and Apple Watch, made by Twilio, a US communications company that bought it in 2015. It generates the six- or eight-digit codes that sites ask for at sign-in and can sync them between your devices through an encrypted backup on Twilio’s servers.

Two things matter most before you install it. You cannot use it without a phone number, which Twilio treats as the key to your account. And the app has no export: Twilio says so itself, so if you leave, you set up two-factor login again at every site.

Where the Secrets Live

Each account you add holds a seed secret: whoever has it can produce your codes without your phone. Twilio says that by default these secrets are stored locally on the phone and that it keeps no record of the accounts you add. The app can ask for a 4-digit PIN, a fingerprint or face check before it opens. This lock is off until you turn it on, and Twilio does not document any other protection of the stored secrets on the phone.

Authy has two kinds of codes. Codes you add yourself by scanning a QR code or typing a key are ordinary TOTP codes. Codes that a site creates in the app because it uses Twilio’s own sign-in service are tied to your phone number and email, and Twilio documents that they sync to its servers even when backups are off. Those sites can also send push requests that you approve in the app.

The Backup and Its Password

The backup is off until you turn it on in the settings. When you do, the app asks for a backup password and, according to Twilio, uses it to encrypt each secret on the phone before uploading it. Twilio says the password never reaches its servers and calls this zero-knowledge encryption. In 2018 Twilio described the method as key derivation with PBKDF2 at 100,000 rounds and AES-256 encryption. The app is closed source and no audit of it has been published, so this is Twilio’s description, not something an outside party has checked.

The backup does not hide everything. Twilio says that with backups on it can see which accounts you have added: for codes added by QR code, the app uploads the QR code’s contents, which usually names the site and your username or email address. The app also keeps syncing new and deleted entries between your devices, and this sync cannot be turned off.

The password has a cost. Twilio cannot reset it, and its account recovery does not reset it either. If you forget it and have no other phone with Authy already unlocked, the copy on Twilio’s servers can never be opened.

Losing Your Phone

With backups off, losing the phone means losing every code you added yourself. You then have to recover access at each site separately, through that site’s own recovery process.

With backups on, you install Authy on a new phone, register the same phone number and enter the backup password. If another device with Authy is still in your hands and you have allowed multi-device, the new phone can be approved from it or by SMS. Without one, Twilio runs an account recovery that takes 24 hours and cannot be sped up.

Your Phone Number and What Twilio Collects

Twilio says the phone number is “at the core” of an Authy account and that whoever holds the number is recognised as the account’s owner. That ties your codes to your identity and to your mobile carrier. Someone who moves your number to their own SIM card in a SIM swap can try to register Authy on their phone; Twilio’s help pages say that with multi-device on, a new device is approved by SMS or from an existing device, and without either, account recovery takes 24 hours. Twilio’s 2022 incident report advises turning multi-device off so that no new devices can be added. Codes created through Twilio’s own service sync to its servers even when backups are off. Twilio also collects an email address for identity checks and account recovery.

Twilio’s privacy notice says that when you sign in with an Authy code at a site that checks it through Twilio’s own Authy service, it logs your IP address, the application and the time. The store declarations list approximate location, device IDs, app interactions, crash logs and diagnostics, and Google Play says device IDs and diagnostics may be shared with other companies. Twilio documents no setting that turns this telemetry off. Since 23 February 2026, the app terms say that new installs and reinstalls may send the device ID, the phone model, whether a VPN or remote access is in use, whether the phone is rooted, and IP-based location to Stytch, an identity company Twilio bought in November 2025; the terms give fraud checks as the purpose.

Moving Your Codes

Authy has no export. Twilio’s guide for the closed desktop apps says it plainly: “The Authy app lacks an export feature”, so moving to another app means turning off two-factor login at each site and setting it up again. The app takes new accounts only through standard setup QR codes and keys. If Twilio stopped supporting Authy, which its terms allow at any time, you would have no documented way to take your secrets with you.

The desktop apps for Windows, macOS and Linux stopped working after 19 March 2024. Twilio had first set the date for August 2024 and then moved it earlier. Authy now runs on Android phones, on iPhone and iPad with iOS 15 or later, and on Apple Watch, and generates codes without an internet connection.

Incidents

Authy’s incident history has two entries, both described on Twilio’s own pages.

In August 2022, attackers tricked Twilio employees into giving up their credentials. Twilio’s report, concluded on 27 October 2022, says the attackers gained access to the accounts of 93 Authy users out of about 75 million and registered additional devices to them. Twilio removed those devices and contacted the users. The report does not say whether the attackers could read any codes; it advised users to add a backup device and then turn off multi-device so no new devices could join.

On 1 July 2024, Twilio said attackers had used an endpoint that required no sign-in to find data tied to Authy accounts, including phone numbers. Twilio secured the endpoint, said it found no evidence that its systems were breached, and asked all users to update the Android and iPhone apps. The leaked numbers can be used for phishing texts that claim to come from Authy.

Open Source and Audits

The app and Twilio’s servers are closed source: the app terms grant a licence to an object-code copy, and there is no public repository. Nobody outside Twilio can check how the app stores secrets on the phone or encrypts the backup. Twilio publishes no security audit of Authy; the certifications on its security page cover the company and, in Twilio’s words, do not apply to every product. Twilio’s bug bounty on HackerOne explicitly includes Authy.

Company and Funding

Authy is owned by Twilio Inc., a Delaware company based in San Francisco whose shares trade on the New York Stock Exchange. The app is free, with no paid tier and no ads; Twilio pays for it as part of its business, and sites can build Authy codes and push approvals into their own sign-in through Twilio’s Authy service. The iPhone app was updated in October 2026.

Pros and Cons

Free, with no ads and no paid tier
Optional backup that Twilio says is encrypted on the phone with a password it never receives
Codes sync between Android, iPhone, iPad and Apple Watch once backups are on
Twilio's bug bounty on HackerOne covers Authy

Requires a phone number, and whoever holds that number is treated as the account's owner
No export: leaving means setting up two-factor login again at every site
Backups are off by default, so a lost phone without them means losing every code
With backups on, Twilio can see which sites and usernames you added
Closed source, with no published security audit
Analytics, location and device data collected with no documented way to turn them off
Attackers added devices to 93 accounts in 2022 and matched phone numbers to accounts in 2024
Desktop apps shut down in March 2024

Our Rating

Secret Custody & Recovery5.5/10
Twilio says the backup is encrypted on your phone with a key from a password it never receives, but the app is closed and no audit checks that. Backups are off until you turn them on, so by default a lost phone means losing every code. Codes that sites create through Twilio's own service sync without that password, and the stored secrets on the phone are protected only by an optional PIN or biometric lock.
Account & Metadata Privacy2.5/10
You cannot use the app without a phone number, and Twilio also collects an email address. The store declarations list location, device IDs, app interactions and diagnostics, some of them shared with other companies, with no setting documented to turn this off. Since February 2026, the app terms say new installs may send device and network details to Stytch, a company Twilio owns.
Transparency & Verifiability2.5/10
The app and its servers are closed source, and Twilio publishes no security audit of Authy. Twilio's bug bounty covers Authy. In 2022 attackers who tricked Twilio employees added devices to 93 Authy accounts, and in 2024 an unprotected endpoint let attackers match phone numbers to Authy accounts.
Usability, Portability & Platforms3.5/10
Apps for Android, iPhone, iPad and Apple Watch, with sync between devices once backups are on. Twilio states that the app has no export, so leaving means setting up two-factor login again at every site. The desktop apps were shut down in March 2024.
Funding & Sustainability5.5/10
The app is free with no ads, and Twilio, a listed company, updated it in October 2026. Twilio has already closed the desktop apps, and its terms let it discontinue the app at any time; with no export, that would leave your codes with nowhere to go.

Overall3.9/10

Secret Custody & Recovery 30% · Account & Metadata Privacy 20% · Transparency & Verifiability 20% · Usability, Portability & Platforms 20% · Funding & Sustainability 10%

See our rating methodology →