Microsoft Authenticator vs Proton Authenticator Comparison

On Android, until you turn on Cloud Backup, the secrets stay on the phone. Microsoft's 2019 description of the backup says the app encrypts it with a key it requests from Microsoft's own key service and fetches that key again to restore, so with backup on Microsoft holds the key to the copy. On iPhone the current help pages do not say whether the app's iCloud switch starts on, or whose key protects the copy. There is no option to protect the backup with a password or key of your own.

Without sync, the secrets stay on the device, encrypted with a random key kept in the system key store (Android Keystore, Apple Keychain, Windows Credential Manager or a Linux Secret Service). With sync, Proton stores an encrypted copy; by Proton's account, only your Proton account key can open it. That is Proton's statement: no independent audit of the app has been published.

Android: the backup is stored with a Microsoft personal account you choose; Microsoft says that from January 2027 the Android backup will move to Google One backup instead. iPhone and iPad: the backup goes to your iCloud account once several iCloud settings and the app's own iCloud switch are on, and Microsoft's current help pages do not say whose key protects it. A backup made on one platform cannot be restored on the other, and work or school accounts are not backed up at all.

Sync to a Proton account is off until you sign in. Automatic backup files to a folder you choose are also off by default on Android; the iPhone app offers them during setup. Backup and export files can be protected with a password of your own. On Apple devices, iCloud sync is a separate switch, off by default.

Codes for other services are added by scanning a QR code, without signing in to Microsoft. A Microsoft personal account is needed for push sign-in to that account and, on Android, to store the backup; on iPhone the backup uses your Apple account's iCloud.

A Proton account is needed only for sync between devices. Google Play's data-safety section lists an email address as the only data collected.

The app is published by Microsoft Corporation of Redmond, Washington. Microsoft's privacy statement names Microsoft Corporation as the controller of personal data, and Microsoft Ireland Operations Limited for people in the European Economic Area, the United Kingdom and Switzerland. Microsoft says it discloses personal data when required by law or to respond to valid legal process.

Published by Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva. Proton's privacy policy says it discloses the limited user data it holds only when legally obliged, on a binding request from the competent Swiss authorities.

Microsoft Corporation is a publicly traded company (ticker MSFT). The app is part of Microsoft's sign-in products for personal Microsoft accounts and for work or school accounts in Microsoft Entra ID.

Proton AG's primary shareholder is the Proton Foundation, a Swiss non-profit registered in Geneva; Proton says no change of control can happen without the Foundation's consent.

The app has no revenue of its own; Microsoft pays for it as part of its sign-in products for personal and work accounts.

The app has no paid tier and no ads and brings in no revenue of its own; Proton AG develops it alongside its other services.