Proton Authenticator is a free app from the Swiss company Proton AG that generates the six-digit codes used for two-factor authentication. It came out in July 2025 and runs on Android, iPhone, Apple Watch, Windows, macOS and Linux.

You do not need an account to use it. With a Proton account, the app syncs your codes between devices and keeps an encrypted copy on Proton’s servers. Proton says only your account key can open that copy; no published audit has checked the claim yet.

Where the Secrets Live

Each code comes from a secret that a website gives you once, usually as a QR code. Whoever holds that secret can make your codes without your phone. Proton Authenticator encrypts the secrets on your device with a random key and keeps that key in the system’s own key store: the Android Keystore, the Apple Keychain, the Windows Credential Manager or a Linux Secret Service. On Windows and Linux computers where that service is missing, the app lets you protect the key with a password instead.

You can lock the app with your fingerprint, your face or your device PIN. With sync and backups off, the secrets stay on the device, and Proton holds neither a copy nor a key to one.

Sync and Backups

Sync is off until you sign in to a Proton account. When you turn it on, the app creates a separate key for your codes, encrypts that key with your Proton account key and encrypts every entry with it before upload. Proton’s servers then hold the encrypted entries, and by Proton’s account nobody at Proton can read them or the key. That is Proton’s own statement: the apps’ code is public, but the server code is not and no audit of the app has been published.

A copy on Proton’s servers protects you from losing a phone, and it also ties your codes to your Proton account. Anyone who gets into the account with its password and second factor can open the synced copy on their own device. Protecting that account with a strong password and a second factor of its own matters here.

The app can also write automatic backup files to a folder you choose, protected with a password you set. Proton says the backup uses well-known open technologies, so you can decrypt it without the app. This is off by default on Android; the iPhone app offers it during first setup. On Apple devices there is a separate iCloud sync switch, also off by default, which relies on Apple’s iCloud Keychain to carry the key.

Losing Your Phone

If sync is on, signing in to your Proton account on a new device brings your codes back. Proton’s help pages warn that after a password reset by email or SMS, encrypted data may stay locked unless you have the account’s recovery phrase, a recovery file or another unlock method, so set those up before you need them.

If you used neither sync nor a backup file, a lost phone means the codes are gone, and you will have to recover access at every service separately.

Account and What the App Reports

Proton advertises the app with “zero data collection” and “no trackers”. The apps from the App Store and Google Play still send crash and diagnostic reports to Proton from start-up: the iPhone app’s code starts this reporting at launch with no setting to turn it off, and the Android app shows switches for crash reports and usage data only to people signed in to a Proton account, while its crash reporter starts at launch regardless. Apple’s privacy label for the app lists diagnostics as “not linked to you”. This is telemetry, not your codes.

The F-Droid version leaves out the crash reporter. F-Droid’s maintainers still mark it with two warnings: it checks Proton’s closed server to see which new features to switch on, and, in F-Droid’s words, “users are fingerprinted even if not using the online features”.

Google Play’s data-safety section lists an email address as the only data the app collects, which comes from the optional Proton account.

Moving Your Codes

The app imports codes from several other authenticator apps and from QR codes. It exports all your codes as a file, either plain or protected with a password of your own; inside, each code is stored in the standard format that most authenticator apps accept. Because the export is complete and uses standard links, leaving the app does not mean setting up two-factor login again at every service.

It supports time-based codes (TOTP) with SHA-1, SHA-256 and SHA-512, and Steam’s own code format. It does not support counter-based codes, which a few services and hardware tokens still use.

Open Source and Audits

The Android app, the iPhone app, the desktop app and the shared core library are all public on GitHub under the GPL v3 open-source licence. The code for Proton’s sync server is not published. F-Droid builds its version of the Android app itself from the published source; the store versions are built by Proton, and the app does not offer reproducible builds that would let you match them to the code.

Proton’s page of audit reports lists no security audit of the app, and Proton’s security write-up says audits will follow and be published. Until then, the claim that Proton cannot read your synced codes rests on Proton’s word and on the public client code. The app is covered by Proton’s bug bounty, with awards of up to $100,000.

Incident: Secrets in the iPhone App’s Logs

The app’s incident history has one entry. On 3 August 2025, days after launch, a user on Reddit reported that the iPhone app’s log file contained the full secrets behind their codes in plain text. They found it while preparing a bug report about entries that had disappeared after editing a label.

Proton said the log stayed on the device and was never sent to its servers, so the risk was to anyone who shared the file, for example with a support request, or who had access to the phone. Proton released version 1.1.1 with changed logging on 4 August 2025 and said the secrets are never sent to its servers in plain text.

Ownership and Jurisdiction

The app is published by Proton AG in Geneva, Switzerland. Proton AG’s main shareholder is the Proton Foundation, a Swiss non-profit, and Proton says no change of control can happen without the Foundation’s consent. Proton’s privacy policy says it hands over the limited data it holds only on a binding request from Swiss authorities.

Apps and Price

The app is free on every platform, with no ads and no paid tier. Downloads are on Google Play, F-Droid, the App Store (iPhone, iPad, Mac and Apple Watch) and Proton’s site for Windows and Linux. There is no web version and no browser extension.

Pros and Cons

Works without any account; with sync and backups off, the secrets stay on your device
Optional sync between phones and computers, encrypted with your Proton account key by Proton's account
Full export as a plain or password-protected file of standard otpauth links
Apps for Android, iPhone, Apple Watch, Windows, macOS and Linux
Open-source apps under GPL v3, covered by Proton's bug bounty
Free, with no ads and no paid tier

Store apps send crash and diagnostic reports from start-up, with no switch on iPhone
No published audit of the app, and the sync server's code is closed
In 2025 the iPhone app wrote secrets into its log file in plain text
Synced codes are only as safe as your Proton account login
No counter-based codes, no browser extension and no web app

Our Rating

Proton Authenticator suits people who want their codes on both phone and computer, with an export they can take elsewhere and the choice to keep everything offline. It is a weaker fit for anyone who wants an app that sends nothing from the device, or who wants the sync encryption checked by an independent audit before trusting it.

Secret Custody & Recovery8.0/10
Without an account the secrets stay on your device, encrypted with a key held in the phone's or computer's own key store. Sync to a Proton account is optional and, by Proton's account, the copy can only be opened with your account key; no audit has checked that yet. Backup files can carry a password of your own, and a lost phone is covered only if you turned on sync or kept a backup file.
Account & Metadata Privacy6.0/10
The app works without any account, and sync needs only a Proton account. Proton advertises zero data collection, but the store apps send crash and diagnostic reports from start-up, the iPhone app has no setting to stop them, and F-Droid flags the Android app for tracking.
Transparency & Verifiability6.5/10
The Android, iPhone and desktop apps are open source under GPL v3, and Proton's bug bounty covers the app. The sync server's code is closed, no audit of the app has been published, and in 2025 the iPhone app wrote secrets into its log file until a fix days after launch.
Usability, Portability & Platforms8.5/10
The app runs on Android, iPhone, Apple Watch, Windows, macOS and Linux, syncs between them and imports from several other authenticator apps. You can export everything as a plain or password-protected file; each code is stored as a standard otpauth link. It does not support [counter-based codes](/glossary/#hotp), and there is no browser extension or web app.
Funding & Sustainability7.5/10
The app is free with no ads and no paid tier, so it earns no money of its own; Proton AG develops it alongside its other services, and the company is controlled by a Swiss non-profit foundation. The app has been out only since 2025.

Overall7.4/10

Secret Custody & Recovery 30% · Account & Metadata Privacy 20% · Transparency & Verifiability 20% · Usability, Portability & Platforms 20% · Funding & Sustainability 10%

See our rating methodology →