Google Authenticator vs Proton Authenticator: Key and Export
Published November 6, 2026· By Juan Martinez
Both are free and neither is audited. What differs: who can open the synced copy of your codes, what you can export, HOTP support and desktop apps.
If your two-factor codes live in Google Authenticator, or you are choosing between it and Proton Authenticator, the two apps look alike at first: both are free, and both can keep a copy of your codes in an account so that a new phone gets them back.
Google Authenticator is Google’s phone app, released in 2010 and reviewed on this site as a point of reference rather than a pick. Proton Authenticator comes from the Swiss company Proton AG and has been out since July 2025.
| Google Authenticator | Proton Authenticator | |
|---|---|---|
| Rating | 4.3 | 7.4 |
| Who Holds the Secrets | Depends on setting | You |
| Backup Locked With | Developer's key | Your password |
| Export Formats | QR codes | Plain file, Encrypted file, otpauth links |
| Import From | QR or links | Other apps |
| Code Types | TOTP, HOTP | TOTP, Steam Guard |
| Platforms | Android, iOS | Android, iOS, Windows, macOS, Linux |
| App Code | Closed | Open source |
| Security Audit | None found | None found |
Want to compare every field side by side? Open the full comparison table.
For Google, “Depends on setting” means Google Account sync or no account at all. For Proton, “You” in the first row rests on Proton’s own description of sync, and “Your password” means your Proton account key for the synced copy and a password you set for backup files.
What Google Authenticator and Proton Authenticator share
Both apps are free, with no ads and no paid tier. Both work without an account (account-less use), and in both, sync to the developer’s servers needs an account with that developer.
Both send data about the app, and neither documents a way to turn it off completely. Google’s store declarations list crash logs, app interactions and device IDs collected for analytics. Proton advertises “zero data collection”, yet its store apps send crash and diagnostic reports from start-up. This is telemetry, not your codes.
Neither app has a published security audit, and both are covered by their company’s bug bounty.
Who holds the key to the synced copy
When you sign in, Google Authenticator copies the seed secrets behind your codes to your Google Account. Google says it encrypts them in transit and at rest, which is encryption at rest with keys Google manages. There is no setting to lock the copy with a key only you hold, so Google can technically decrypt it.
When you turn on sync in Proton Authenticator, the app encrypts every entry before upload with a key that is itself locked with your Proton account key, and Proton says nobody at Proton can read either. That is Proton’s statement: the server code is not public and no published audit has checked it. So key custody for the synced copy sits with Google in one app and, by Proton’s account, with you in the other.
A key of your own does not help against someone who signs in as you: whoever takes over either account can open the synced codes.
Ownership matters in one more case. Google LLC, part of Alphabet, is a US company that can decrypt the synced codes, so a valid order for the account’s content can reach them. Proton AG, in Geneva and controlled by the non-profit Proton Foundation, says it hands over the limited data it holds only on a binding request from Swiss authorities.
What each app lets you take out
Google Authenticator’s only export is Transfer codes: QR codes that Google describes only as a way to move codes to Google Authenticator on another phone. There is no backup file and no standard link for each account.
Proton Authenticator exports all your codes as one file, plain or protected with a password of your own, and each code inside is a standard otpauth link that most authenticator apps accept. It also imports from several other authenticator apps. A plain export file holds every secret in readable form.
If you lose your phone
With sync on, both apps bring the codes back when you sign in on a new phone. Proton warns that after a password reset by email or SMS, encrypted data may stay locked unless you have the account’s recovery phrase, a recovery file or another unlock method, so these are worth setting up before you need them.
Without sync, Google Authenticator makes no backup at all, so a lost phone means relinking every site. Proton Authenticator can write backup files to a folder you choose, and you can protect them with a password of your own; this is off by default on Android, and the iPhone app offers it during setup. Without sync or a backup file, both apps leave you recovering access at every service.
Platforms and code types
Google Authenticator runs on Android, iPhone and iPad, with no desktop version, and supports time-based and counter-based codes (TOTP and HOTP). Proton Authenticator adds Apple Watch, Windows, macOS and Linux, and supports Steam’s own format, but not counter-based codes, which a few services and hardware tokens still use. Neither has a browser extension.
Open code and audits
Google Authenticator and the service that stores synced codes are closed source; the open-source Android version Google once published was archived in 2020 and differs from the store app. Proton’s Android, iPhone and desktop apps are public under GPL v3, while the sync server’s code is not. Proton says audits of the app will follow and be published.
What has gone wrong with each
Google Authenticator has no incident of its own on record. In August 2023 an attacker phished an employee of the software company Retool and reached the employee’s Google account, and with it every code synced there. It was not a flaw in the app or a breach of Google.
On 3 August 2025, days after launch, a user reported that Proton Authenticator’s iPhone app wrote the full secrets into its log file in plain text. Proton said the log stayed on the device and released version 1.1.1 with changed logging on 4 August 2025.
Which app suits whom
Google Authenticator is enough for someone who needs counter-based codes, uses only phones, already lives in a Google Account and accepts that Google can decrypt the synced copy. Without an account it makes no backup.
Proton Authenticator suits someone who wants the synced copy locked with their own account key (by Proton’s account), a full export in a standard format, a backup file in a folder of their choice, or codes on a computer too. It is a weaker fit for anyone who wants that encryption checked by an independent audit first, or an app that sends nothing from the device.
What we didn’t compare, and why
Other authenticator apps. Apps that keep codes with no account at all, or sync them with a key only you hold, are covered in why Google and Microsoft Authenticator aren’t the best choice.
Summary
The ratings are 4.3 for Google Authenticator and 7.4 for Proton Authenticator. The gap sits in Secret Custody & Recovery (3.5 against 8.0), Transparency & Verifiability (3.0 against 6.5) and Usability, Portability & Platforms (5.5 against 8.5); Funding & Sustainability is close, 7.0 against 7.5.
Read the full Google Authenticator review and the full Proton Authenticator review for the details behind each score.