Two-factor codes are one of those problems that starts small and gets big without you noticing. On day one, you have Google Authenticator with three codes in it. Two years later, it has forty codes for services you have half-forgotten, one of them the only way back into your main bank account, and you are about to change phones.
Aegis Authenticator is designed for the moment you realise the pile matters. It is open source, offline by default, encrypted with a passphrase you control, and it has a real export format. If you do only one thing after reading this, migrate your 2FA to Aegis this weekend. You will not regret it.
What Aegis does
Aegis stores the same TOTP and HOTP codes any authenticator app stores. Numbers rotate every 30 seconds. The interface is a scrollable list of your services, each with a small logo, a code, and a countdown ring. Search jumps you to the code you want. That is the core.
Everything else about the app is aimed at three questions: is the pile safe, is the pile portable, and can I recover if my phone dies?
Encryption you actually control
When you first set up Aegis, it asks you for a passphrase. The passphrase encrypts the whole vault on your device. If your phone is stolen and someone dumps the app’s storage, they get a blob they cannot read without your passphrase.
This is different from Google Authenticator’s cloud sync (a Google account away from a bad day) and from Authy (an SMS-linked account away). Aegis has no account, no cloud, no server. The only copy is the one on your phone plus the backups you make.
Backups that are actually portable
Aegis’s export format is documented and readable by other authenticator apps that support the standard. You can export to an encrypted JSON file (passphrase-protected) and store it anywhere — your own cloud, a USB stick, an email to yourself.
This is the single feature that matters most in practice. When you buy a new phone, you install Aegis, tap “Import from file”, pick your export, type your passphrase, and every code you had is back. No SMS verification. No cloud login. No hostage account.
Restoring on a new phone
Six months from now, you will drop your phone in the sink. Here is what Aegis makes possible if you set it up today:
- Install Aegis on the new phone.
- Copy your last encrypted export back to the new phone (from wherever you stored it — cloud drive, email, USB).
- Open Aegis → Settings → Import → pick the file → enter the passphrase.
- Every 2FA code is back. You can sign in to every service without waiting for account-recovery emails.
The one job most authenticator apps do badly, Aegis does in four steps.
Small things that add up
- Icon pack support. Aegis knows the logo for hundreds of common services and can auto-assign them.
- Groups. Sort your codes into Work / Personal / Finance. When you have thirty of them, the difference is real.
- Biometric unlock. After the passphrase is set, you can unlock the app with a fingerprint each session — with the passphrase still required after a reboot.
- Panic wipe option. A shortcut you can enable that wipes the vault after N failed unlock attempts.
- Search by service or account name. Type “gmail” or “workaccount@” and the right code jumps to the top.
What Aegis is not
Aegis does not sync. If you want your codes on two devices, you export from one and import to the other. Some people want continuous sync between a phone and a tablet — for that, look at Ente Auth (also open source, with true end-to-end encrypted cloud sync). Aegis’s design philosophy is that the local, offline copy is the safest one, and there is a real security argument for that.
The verdict
5 / 5. Aegis is free, open source, and does the single most important job in a stressful moment — restoring on a new phone — better than every commercial competitor. If you are still using SMS codes, move to any authenticator. If you are on Google Authenticator or Authy, move to Aegis this weekend and export a backup you keep somewhere off-device.
Where to get it: the official Aegis Authenticator listing on the Google Play Store.