Best European Alternatives to Authy

Why people leave Authy

Authy costs nothing, so the usual comparison — European product, similar features, better price — has no purchase here. Nobody is overpaying for Authy. What they are paying is something else.

In August 2024 Twilio ended the Authy desktop applications for Windows, macOS and Linux. People who generated their codes on a laptop lost the client they had been using, and what remained were the Android and iOS apps. The product did not get worse; a part of it was removed by the company that owns it.

That would be a minor annoyance if you could take your codes elsewhere. You cannot: Authy has never had an export function. Leaving means signing in to every service you protected, turning two-factor authentication off, and turning it back on against a new app, one account at a time. The longer you stay, the more that costs — which is the real price of a free product.

• There is no export, so the exit gets more expensive every month Every other app on this page will hand you your seeds in a file. Authy will not. That means the switching cost is not a download but an afternoon of disabling and re-enrolling two-factor authentication across thirty or eighty accounts, each with its own settings page and its own recovery codes to write down. Nothing about that is accidental, and nothing about it is going to change.
• Twilio removed the desktop client The Windows, macOS and Linux apps were discontinued in August 2024, leaving phones as the only place Authy runs. For anyone who signs in to internal systems on a desktop all day, that turned a two-second copy-and-paste into picking up a handset several dozen times a day. It also demonstrates the general point: the client you rely on exists at the vendor's discretion.
• The account is a phone number, and the phone numbers leaked In July 2024 attackers used an unauthenticated Twilio endpoint to confirm the phone numbers attached to 33 million Authy accounts. No codes or seeds were taken. What was taken is a list of numbers known to belong to people who use two-factor authentication, which is precisely the audience for a SIM-swap or a smishing campaign, and a number is much harder to change than a password.
• It is a side product of a communications company Twilio Inc. in San Francisco sells messaging and voice APIs to developers; a consumer authenticator app is not the business. That is the context for the desktop shutdown and for an endpoint that went unauthenticated. It is also United States jurisdiction, which matters less here than elsewhere — the seeds are end-to-end encrypted under your backup password — but the phone number, the email address and the list of services you enrolled are not the same category of secret.

What you have to replace, not just match

Work out which Authy you are using, because the two versions of it land in different places.

One is Authy as a plain code generator on a single phone. Replacing that is easy and both options here do it better, with an export function attached. The other is Authy as a synchronised service: encrypted cloud backup, the same tokens on a tablet and a second handset, recoverable if the phone goes into a canal. That is the part Authy genuinely does well and the part a local-only app does not do at all.

Aegis is the answer for the first and refuses the second on purpose. Proton Authenticator, the free app from the company behind Proton Pass, is the only option here that covers both, and it is also the only one that puts codes back on a desktop after Twilio took that away.

The alternatives compared

How each alternative compares to Authy

What actually breaks when you switch

The migration is manual and there is no shortcut, so treat it as an inventory exercise first. Open Authy, list every token in it, and work down that list rather than relying on memory — the accounts people forget are the ones they enrolled once and never signed out of, which are also the ones with the slowest recovery process.

Collect recovery codes as you go. Most services offer a set of one-time codes at the moment you enrol a new authenticator, and that is the only point at which they are easy to get. Printed and kept somewhere physical, they are what saves you when a phone is stolen on the third day of a migration.

And do not delete Authy on the day you finish. Leave it installed for a fortnight with the tokens intact, because the accounts you missed announce themselves the next time you sign in to them, and until then Authy is the only thing that still has their seeds.

How do I actually get my codes out of Authy?

By hand, service by service, and there is no trick that avoids it. Authy publishes no export, so the procedure is: install the new app, then for each account open its security settings, remove the existing authenticator, scan the new QR code, confirm with a fresh code, and save the recovery codes the service offers you.

Do it in an order and do not do it all in one sitting. Start with email, because it is the recovery path for the rest. Then anything with money in it. Then work accounts, where an administrator can usually reset you if it goes wrong. Leave the long tail of forums and shopping sites for whenever you next sign in to them.

Keep Authy installed until the last account is confirmed working on the new app. The failure people actually hit is deleting Authy after a successful-looking migration and then discovering one account was never re-enrolled, on a service whose account recovery takes five working days.

Is Authy unsafe after the 2024 phone number exposure?

The tokens themselves were not affected. What attackers obtained through the unauthenticated endpoint was confirmation of which phone numbers were registered, not seeds, not codes and not backups.

The harm is indirect and durable. A verified list of people who use two-factor authentication is a good target list: convincing smishing that claims to be from Authy or from a service you use, and SIM-swap attempts against numbers now known to be worth swapping. Authy accounts are keyed to a phone number, so this is the identifier the account is built on rather than an incidental field.

Treat it as a reason to review how your mobile operator authenticates a SIM change, which is worth doing regardless, rather than as evidence your codes are compromised. They are not.

Do I lose multi-device sync if I leave?

Only if you choose Aegis, and that is deliberate rather than a gap. Aegis keeps an encrypted vault on the device and writes automatic backups to a location you pick, which might be a folder your own sync tool handles. There is no account, no server and therefore no sync in the sense Authy means it.

Proton Authenticator does sync, end to end encrypted, across Android, iOS, Windows, macOS and Linux, and it will also run with no account at all if you would rather keep it local. That combination — optional account, every platform, free — is not something Authy offered even before the desktop apps were withdrawn.

Whichever you choose, write down or print the recovery codes each service gives you when you enrol. They are the real backup, and they work when every app on this page has failed you.

Should my two-factor codes live in my password manager?

It is a genuine trade rather than a rule. Proton Pass includes a built-in authenticator on Pass Plus, and putting codes beside the passwords makes signing in one step instead of two, which is why people who do it stop losing accounts to abandoned second factors.

The objection is that both factors then sit behind one master password, which turns two factors into one with extra steps. For a bank, a domain registrar or anything holding client data, keep the second factor in a separate app.

A reasonable split is the one most careful people settle on anyway: codes for high-value accounts in a dedicated authenticator, codes for the forty sites that forced two-factor on you in the password manager. That is not a compromise so much as an accurate reading of how much each account is worth.

Which one to pick

If you are on Android and what you want is your codes in a file with nobody in between, Aegis is the answer and the lack of a company behind it is the feature rather than the risk. Set up the automatic backup on the first day, not the day after you drop the phone.

If you used Authy on a computer and lost that in August 2024, or you need the same tokens on two devices, Proton Authenticator is the only option here that covers it, and it costs nothing.

If you want the codes beside the passwords, Proton Pass does that on Pass Plus — but keep your bank, your email and your domain registrar in a separate app, because two factors behind one master password is one factor wearing a hat.

Whichever you pick, the reason to move now rather than later is arithmetic. Authy has no export, so the migration is priced per account, and that price only goes up.