Authy vs Google Authenticator Comparison

With backups off, Twilio says the codes you add stay only on the phone. With backups on, Twilio says the app encrypts each secret on the phone with a key made from your backup password, which never reaches its servers. That is Twilio's statement about closed-source software, with no published audit. It covers codes you add by QR code or key; codes that a website creates in the app through Twilio's own service sync to Twilio's servers even on a device where backups are off.

Signed in to a Google Account, the app copies your secrets to that account, where Google says it encrypts them in transit and at rest. Choosing Use without an account keeps the codes only on the phone. There is no option to encrypt the synced copy with a password or key of your own, so Google can technically decrypt it.

Backups are off until you turn them on and set a backup password. The copy lives on Twilio's servers, tied to your phone number. Twilio cannot reset the backup password: if you forget it and lose your phones, the copy cannot be opened. With backups on, Twilio can see which accounts you added, as far as the setup QR code names them, usually the site and your username or email.

The only backup is the copy in your Google Account. Without an account, the app makes no backup file; codes can only be moved by scanning transfer QR codes from the old phone.

An Authy account needs a phone number, verified by a code, and Twilio also collects an email address for identity checks and account recovery. Twilio says whoever holds the phone number is treated as the account's owner.

A Google Account is needed only for syncing. The app works without one, and Google's help page describes how to use it that way from the first launch.

The app terms are with Twilio Inc., a company incorporated in Delaware in 2008 with its head office in San Francisco, California. The App Store lists the seller as Authy Inc., and Google Play lists the developer as Twilio Inc.

The app is published by Google LLC, a Delaware company based in Mountain View, California. Google's terms are governed by California law unless local law requires otherwise; Google says that for most services the provider is either Google LLC, operating under US law, or Google Ireland Limited, operating under Irish law.

Twilio bought Authy in 2015. Twilio's shares trade on the New York Stock Exchange under TWLO.

Google LLC is a wholly owned subsidiary of Alphabet Inc., whose shares trade on Nasdaq. Google released Authenticator in 2010 and added Google Account sync in April 2023.

The app has no paid tier and no ads. Twilio pays for it as part of its business; websites can also build Authy codes and push approvals into their own sign-in through Twilio's Authy service.

The app has no revenue of its own; Google pays for its development as part of its account-security products.