Authy

PCMag editors select and review products independently. If you buy through affiliate links, we may earn commissions, which help support our testing.

Authy has been a powerhouse in the authenticator market for many years, even before its acquisition by Twilio in 2015. In recent years, however, high-profile security incidents affecting Authy customers have made headlines. It's unfortunate because Authy's user interface looks great, and the app functioned well during our recent tests. That said, Authy requires account creation via a phone number, which is not ideal. The app's inability to export or import tokens makes it very inconvenient to switch to Authy from a different authenticator app, too. We recommend choosing apps that collect minimal data and don't require an account to work, like 2FAS, our Editors' Choice for authentication.

Recent Security Incidents at Twilio

In July 2024, Twilio announced that "threat actors" had acquired more than 33 million Authy customers' phone numbers. This comes two years after a different security incident compromised Authy customers.

We contacted Authy for a response to the recent security incident. A spokesperson stated, "The security of our products and our customers' data is of paramount importance. We saw no evidence that the threat actors breached Twilio's systems or obtained sensitive internal data, but as a precaution requested all Authy users to update their apps for the latest security updates."

You should use any authenticator app with caution. Anyone with access to your tokens may be able to access your accounts. To protect your tokens, hide them from anyone peeking over your shoulder or otherwise surveilling your on-screen activity. Authy hides all but one of your tokens from view by default, which is a good idea. You can go a step further by locking access to your token screen behind your devices' biometrics. 2FAS and Google Authenticator allow you to lock and unlock your token vault using a face scan too, though 2FAS offers an additional option to hide all of your tokens at all times.

Getting Started With Authy

Authy is available for Android and iOS devices. We tested the Authy app using a Samsung Galaxy A71 5G, an iPhone 12 mini, and an iPhone 14 Pro.

Signup Requirements

To use multi-factor authentication (MFA) with a service that supports it, you only need a simple token generator. With that in mind, we don't think you should have to hand over an email address, a phone number, or any other personal information to use an authenticator app.

Authy needs your phone number and country code to work on your mobile device. By comparison, 2FAS and Google Authenticator do not require any information or account creation to use the app.

You can register the app with the same account across multiple devices, though Authy doesn't offer multi-device registration by default for security reasons. You'll need to enable it in the Settings menu. We tested this capability with two iPhones and were able to use the app seamlessly.

Data Collection Policies

While testing these apps, we noticed that some collect a lot more data than others, especially given their highly specific functionality. According to the Google Play Store, the Authy app for Android may collect your email address, location data, and phone number. To compare, Google's Authenticator app collects data from at least eight categories, including your phone's Contact list, the photos and videos on your device, plus your phone number and physical address. Of the apps we've tested, 2FAS collects the least amount of personal data.

Hands On With Authy

Authy's apps for Android and iOS feature spartan yet sleek user interfaces, with each website token's associated logo prominently displayed. As we mentioned above, we like that, unlike Google Authenticator, only one token is displayed at a time by default. You can lock the app using either a PIN or biometrics. For example, on iOS, you can use FaceID to open Authy.

Hunting for a website or other online platform's MFA section in the Settings menu can be a pain. Thankfully, Authy takes some of the work out of setting up MFA for your accounts by providing written instructions with screenshots for at least 30 platforms and websites, including Cloudflare, Discord, Epic Games, Grammarly, and Snapchat.

To add a code to your token list, scan a QR code or enter a code manually to register the app for MFA on your preferred website. We were able to register our X.com test account with the Authy app, as expected. To use Authy while logging in, enter the six-digit code shown on the app dashboard.

Unlike 2FAS, Authy does not allow you to import tokens from competing authenticator apps. That makes switching from a different authenticator app to Authy pretty difficult.

Here's how to switch from your old authenticator app to Authy:

1. Sign in to your online accounts.

2. Disable MFA for each platform or website.

3. Re-enable MFA.

4. Scan the associated QR code for every entry.

If you're like us and you have MFA codes for all of your online accounts, switching away from Authy will be inconvenient and time-consuming. You also risk locking yourself out of an account if you forget to switch every single one in your vault to Authy and delete the old authenticator app. Authy doesn't allow you to export your authentication codes either, so it's as difficult to leave the app as it does to switch to it.

Backing Up Account Info With Authy

Once you're all set up, Authy will back up your MFA tokens to their cloud server, which you'll need if you ever get a new phone or lose your old one. Backing up your tokens is optional. According to a post on Authy's blog, your files are encrypted on your device and then sent to Authy's cloud storage. In the future, we'd like to see an option to back up our data to secure online storage of our choosing, or online storage that isn't controlled by Twilio. 2FAS allows backing up to both iCloud and and Google Drive, while Google Authenticator only backs up Google Drive.

Verdict: Authy Works Well, But Security Concerns Continue

As mentioned, Authy needs to rebuild its reputation after a few recent, notable security incidents. The app's user interface is very well designed, and we were impressed with the detailed guides for new users. That said, we see room for improvement. Allowing you to use the app without creating an account would be a good start, and we'd like to have a way to export or import tokens from other apps. Editors' Choice Award winner 2FAS is an open-source alternative that does not require account creation or your phone number to work.