Aegis Authenticator vs Authy Comparison

The secrets live in a vault file on the phone. The app has no internet permission and no account, so there is no copy with the developers. Setup offers a password by default; choosing no password leaves the vault unencrypted on the phone.

With backups off, Twilio says the codes you add stay only on the phone. With backups on, Twilio says the app encrypts each secret on the phone with a key made from your backup password, which never reaches its servers. That is Twilio's statement about closed-source software, with no published audit. It covers codes you add by QR code or key; codes that a website creates in the app through Twilio's own service sync to Twilio's servers even on a device where backups are off.

Automatic backups are off until you switch them on and pick a folder, which can belong to a cloud app on the phone. Android's own cloud backup can also include the vault after you switch it on. Both work only with a password-protected vault and use your password or a separate backup password. Android's direct phone-to-phone transfer is always allowed to include the vault.

Backups are off until you turn them on and set a backup password. The copy lives on Twilio's servers, tied to your phone number. Twilio cannot reset the backup password: if you forget it and lose your phones, the copy cannot be opened. With backups on, Twilio can see which accounts you added, as far as the setup QR code names them, usually the site and your username or email.

There is no account and no sign-up; the app works fully offline.

An Authy account needs a phone number, verified by a code, and Twilio also collects an email address for identity checks and account recovery. Twilio says whoever holds the phone number is treated as the account's owner.

The Google Play listing gives Beem Development's contact address in Dordrecht, Netherlands. The app has no servers and holds no user data with the developers, so the jurisdiction matters little for the secrets themselves.

The app terms are with Twilio Inc., a company incorporated in Delaware in 2008 with its head office in San Francisco, California. The App Store lists the seller as Authy Inc., and Google Play lists the developer as Twilio Inc.

Beem Development is the developer name on Google Play, F-Droid and the website. Most of the code on GitHub comes from two developers, and the project is funded by donations; no company registration is named on the project's pages.

Twilio bought Authy in 2015. Twilio's shares trade on the New York Stock Exchange under TWLO.

The README and F-Droid link a donation page; there is no paid version.

The app has no paid tier and no ads. Twilio pays for it as part of its business; websites can also build Authy codes and push approvals into their own sign-in through Twilio's Authy service.