2FAS vs Authy Comparison

2FAS keeps the secrets on your phone and has no copy of them. On Android the app's database is encrypted with a random key protected by the phone's keystore. On iPhone, according to the app's public source code, its own encryption of stored secrets uses a key built into the app, so the protection there comes from the phone itself and its passcode. If you turn on the Android Google Drive backup without a backup password, Google stores a readable copy. A PIN or biometric lock for the app is optional.

With backups off, Twilio says the codes you add stay only on the phone. With backups on, Twilio says the app encrypts each secret on the phone with a key made from your backup password, which never reaches its servers. That is Twilio's statement about closed-source software, with no published audit. It covers codes you add by QR code or key; codes that a website creates in the app through Twilio's own service sync to Twilio's servers even on a device where backups are off.

Not encrypted on Android unless you set a backup password; encrypted on iPhone. The backup is off until you turn it on; the Android app reminds you on its home screen. On Android the copy goes to a hidden folder of your Google Drive and Google can read it if you set no password. On iPhone the copy goes to iCloud, encrypted by the app with a random key kept in your iCloud Keychain, or with a key made from your own password if you set one.

Backups are off until you turn them on and set a backup password. The copy lives on Twilio's servers, tied to your phone number. Twilio cannot reset the backup password: if you forget it and lose your phones, the copy cannot be opened. With backups on, Twilio can see which accounts you added, as far as the setup QR code names them, usually the site and your username or email.

2FAS has no accounts of its own. The optional cloud backup uses your Google account on Android and your Apple account on iPhone.

An Authy account needs a phone number, verified by a code, and Twilio also collects an email address for identity checks and account recovery. Twilio says whoever holds the phone number is treated as the account's owner.

The app is published by Two Factor Authentication Service, Inc., which gives an address in Henderson, Nevada. Its licence agreement for the app is governed by the laws of Delaware, with disputes going to Delaware courts or arbitration.

The app terms are with Twilio Inc., a company incorporated in Delaware in 2008 with its head office in San Francisco, California. The App Store lists the seller as Authy Inc., and Google Play lists the developer as Twilio Inc.

2FAS says the company was founded in 2015 and its team works fully remotely. It also makes 2FAS Pass, a password manager with a paid plan.

Twilio bought Authy in 2015. Twilio's shares trade on the New York Stock Exchange under TWLO.

2FAS Auth is free and has no ads. The company takes donations through PayPal and says they go to app development; it also sells a yearly plan of its separate password manager.

The app has no paid tier and no ads. Twilio pays for it as part of its business; websites can also build Authy codes and push approvals into their own sign-in through Twilio's Authy service.