2FAS vs Google Authenticator Comparison

2FAS keeps the secrets on your phone and has no copy of them. On Android the app's database is encrypted with a random key protected by the phone's keystore. On iPhone, according to the app's public source code, its own encryption of stored secrets uses a key built into the app, so the protection there comes from the phone itself and its passcode. If you turn on the Android Google Drive backup without a backup password, Google stores a readable copy. A PIN or biometric lock for the app is optional.

Signed in to a Google Account, the app copies your secrets to that account, where Google says it encrypts them in transit and at rest. Choosing Use without an account keeps the codes only on the phone. There is no option to encrypt the synced copy with a password or key of your own, so Google can technically decrypt it.

Not encrypted on Android unless you set a backup password; encrypted on iPhone. The backup is off until you turn it on; the Android app reminds you on its home screen. On Android the copy goes to a hidden folder of your Google Drive and Google can read it if you set no password. On iPhone the copy goes to iCloud, encrypted by the app with a random key kept in your iCloud Keychain, or with a key made from your own password if you set one.

The only backup is the copy in your Google Account. Without an account, the app makes no backup file; codes can only be moved by scanning transfer QR codes from the old phone.

2FAS has no accounts of its own. The optional cloud backup uses your Google account on Android and your Apple account on iPhone.

A Google Account is needed only for syncing. The app works without one, and Google's help page describes how to use it that way from the first launch.

The app is published by Two Factor Authentication Service, Inc., which gives an address in Henderson, Nevada. Its licence agreement for the app is governed by the laws of Delaware, with disputes going to Delaware courts or arbitration.

The app is published by Google LLC, a Delaware company based in Mountain View, California. Google's terms are governed by California law unless local law requires otherwise; Google says that for most services the provider is either Google LLC, operating under US law, or Google Ireland Limited, operating under Irish law.

2FAS says the company was founded in 2015 and its team works fully remotely. It also makes 2FAS Pass, a password manager with a paid plan.

Google LLC is a wholly owned subsidiary of Alphabet Inc., whose shares trade on Nasdaq. Google released Authenticator in 2010 and added Google Account sync in April 2023.

2FAS Auth is free and has no ads. The company takes donations through PayPal and says they go to app development; it also sells a yearly plan of its separate password manager.

The app has no revenue of its own; Google pays for its development as part of its account-security products.