A private alternative to Authy

Authy still works on iPhone. But it ties your codes to your phone number, it can't export them, and its desktop apps are gone. A good alternative makes the same six-digit codes, needs no account, and lets you take your codes with you whenever you like.

Why people leave Authy

• You sign up with your phone number. In July 2024 Twilio, which owns Authy, said attackers had used an unprotected endpoint to find the phone numbers behind Authy accounts, and warned users about phishing texts. Twilio's security alert
• There's no export. Even Twilio says switching means setting up two-factor login again for every account. The Register
• The desktop apps are gone. Authy for Windows, Mac and Linux reached end of life on 19 March 2024. Twilio

What to look for

• Standard codes (TOTP). Then the app works with every service that asks for an “authenticator app”.
• An export. You can always take your codes elsewhere, as QR codes or a file.
• No account and no phone number. Nothing to leak, nothing to sign in to.
• A backup you control. Sync that's end-to-end encrypted, or a backup file with a password.
• A lock. Face ID, and codes hidden when you switch apps.

Options on iPhone

• Apple's Passwords app (iOS 18 and later) can keep verification codes next to your passwords, synced with iCloud Keychain. Good if you already use it for passwords. Apple Support
• Google Authenticator can export every account as QR codes. Syncing needs a Google Account.
• Microsoft Authenticator can't export to other apps.
• 2FAS and Ente Auth are free and open source, and both can export.
• Kode is the one we make – see below.

How to move from Authy

1. Install the new app, but keep Authy for now.
2. Sign in to one service at a time, find two-factor login in the security settings, and choose to change the authenticator app.
3. Scan the new QR code with the new app, and enter the code to confirm.
4. Sign out and back in with the new code. Only delete the account from Authy once that works.

Watch out for 7-digit codes. A few services, Twitch among them, are set up through Authy's own system and show seven digits. Those codes only work in Authy. Check them before you delete your Authy account, so you don't lock yourself out.

The full guide, with links to the settings at Google, Microsoft, GitHub and others: Move your codes to Kode.

Kode: login codes without an account

Kode is a free iPhone app by Peter Theill. No account, no phone number, no ads and no network calls. Your keys live in the iPhone's Keychain and follow you to a new iPhone through iCloud Keychain, which is end-to-end encrypted.

You can always leave: show any account as a QR code, or export an encrypted backup in an openly documented format. Kode imports from Google Authenticator, 2FAS, Aegis, 1Password, Bitwarden and files with otpauth:// links. Not from Authy – because Authy can't export.