2FAS vs Microsoft Authenticator Comparison

2FAS keeps the secrets on your phone and has no copy of them. On Android the app's database is encrypted with a random key protected by the phone's keystore. On iPhone, according to the app's public source code, its own encryption of stored secrets uses a key built into the app, so the protection there comes from the phone itself and its passcode. If you turn on the Android Google Drive backup without a backup password, Google stores a readable copy. A PIN or biometric lock for the app is optional.

On Android, until you turn on Cloud Backup, the secrets stay on the phone. Microsoft's 2019 description of the backup says the app encrypts it with a key it requests from Microsoft's own key service and fetches that key again to restore, so with backup on Microsoft holds the key to the copy. On iPhone the current help pages do not say whether the app's iCloud switch starts on, or whose key protects the copy. There is no option to protect the backup with a password or key of your own.

Not encrypted on Android unless you set a backup password; encrypted on iPhone. The backup is off until you turn it on; the Android app reminds you on its home screen. On Android the copy goes to a hidden folder of your Google Drive and Google can read it if you set no password. On iPhone the copy goes to iCloud, encrypted by the app with a random key kept in your iCloud Keychain, or with a key made from your own password if you set one.

Android: the backup is stored with a Microsoft personal account you choose; Microsoft says that from January 2027 the Android backup will move to Google One backup instead. iPhone and iPad: the backup goes to your iCloud account once several iCloud settings and the app's own iCloud switch are on, and Microsoft's current help pages do not say whose key protects it. A backup made on one platform cannot be restored on the other, and work or school accounts are not backed up at all.

2FAS has no accounts of its own. The optional cloud backup uses your Google account on Android and your Apple account on iPhone.

Codes for other services are added by scanning a QR code, without signing in to Microsoft. A Microsoft personal account is needed for push sign-in to that account and, on Android, to store the backup; on iPhone the backup uses your Apple account's iCloud.

The app is published by Two Factor Authentication Service, Inc., which gives an address in Henderson, Nevada. Its licence agreement for the app is governed by the laws of Delaware, with disputes going to Delaware courts or arbitration.

The app is published by Microsoft Corporation of Redmond, Washington. Microsoft's privacy statement names Microsoft Corporation as the controller of personal data, and Microsoft Ireland Operations Limited for people in the European Economic Area, the United Kingdom and Switzerland. Microsoft says it discloses personal data when required by law or to respond to valid legal process.

2FAS says the company was founded in 2015 and its team works fully remotely. It also makes 2FAS Pass, a password manager with a paid plan.

Microsoft Corporation is a publicly traded company (ticker MSFT). The app is part of Microsoft's sign-in products for personal Microsoft accounts and for work or school accounts in Microsoft Entra ID.

2FAS Auth is free and has no ads. The company takes donations through PayPal and says they go to app development; it also sells a yearly plan of its separate password manager.

The app has no revenue of its own; Microsoft pays for it as part of its sign-in products for personal and work accounts.