Authy vs Proton Authenticator Comparison

With backups off, Twilio says the codes you add stay only on the phone. With backups on, Twilio says the app encrypts each secret on the phone with a key made from your backup password, which never reaches its servers. That is Twilio's statement about closed-source software, with no published audit. It covers codes you add by QR code or key; codes that a website creates in the app through Twilio's own service sync to Twilio's servers even on a device where backups are off.

Without sync, the secrets stay on the device, encrypted with a random key kept in the system key store (Android Keystore, Apple Keychain, Windows Credential Manager or a Linux Secret Service). With sync, Proton stores an encrypted copy; by Proton's account, only your Proton account key can open it. That is Proton's statement: no independent audit of the app has been published.

Backups are off until you turn them on and set a backup password. The copy lives on Twilio's servers, tied to your phone number. Twilio cannot reset the backup password: if you forget it and lose your phones, the copy cannot be opened. With backups on, Twilio can see which accounts you added, as far as the setup QR code names them, usually the site and your username or email.

Sync to a Proton account is off until you sign in. Automatic backup files to a folder you choose are also off by default on Android; the iPhone app offers them during setup. Backup and export files can be protected with a password of your own. On Apple devices, iCloud sync is a separate switch, off by default.

An Authy account needs a phone number, verified by a code, and Twilio also collects an email address for identity checks and account recovery. Twilio says whoever holds the phone number is treated as the account's owner.

A Proton account is needed only for sync between devices. Google Play's data-safety section lists an email address as the only data collected.

The app terms are with Twilio Inc., a company incorporated in Delaware in 2008 with its head office in San Francisco, California. The App Store lists the seller as Authy Inc., and Google Play lists the developer as Twilio Inc.

Published by Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva. Proton's privacy policy says it discloses the limited user data it holds only when legally obliged, on a binding request from the competent Swiss authorities.

Twilio bought Authy in 2015. Twilio's shares trade on the New York Stock Exchange under TWLO.

Proton AG's primary shareholder is the Proton Foundation, a Swiss non-profit registered in Geneva; Proton says no change of control can happen without the Foundation's consent.

The app has no paid tier and no ads. Twilio pays for it as part of its business; websites can also build Authy codes and push approvals into their own sign-in through Twilio's Authy service.

The app has no paid tier and no ads and brings in no revenue of its own; Proton AG develops it alongside its other services.