Two-Factor Authenticator App Reviews
Can you export your 2FA codes to another app?
We do not currently have an affiliate relationship with any product on this page, and no vendor paid for placement or review. Outbound product links are marked nofollow.
The Short Answer
- Aegis Authenticator — Aegis lists "Export (plaintext or encrypted)" among its core features and names ten competing apps it can import from, including Authy.
- Ente Auth — Ente's encrypted export decrypts to "otpauth://totp/..., separated by a new line", and a "Plain HTML" export produces QR codes its FAQ confirms scan into Google Authenticator.
- 2FAS — 2FAS states its export files "are essentially text files in JSON format", and that exported without a password "all data, including sensitive information like your secret keys, is readable".
- Twilio Authy — Twilio's help article is titled "Export or Import Tokens in the Authy app Not Supported" and states "the Authy application does not allow importing or exporting 2FA account tokens".
| Product | Best for | From | Free plan | Seed export |
|---|---|---|---|---|
| Aegis Authenticator | Export is a headline feature, in plaintext | Free only | Yes | Exports freely |
| Ente Auth | Encrypted sync that still decrypts to an open standard | Free only | Yes | Exports freely |
| 2FAS | A JSON file with the secrets readable in a text editor | Free only | Yes | Exports freely |
| Twilio Authy | No export, and no price that changes it | Free only | Yes | No export, at any price |
The one verdict on this site that money cannot change
Thirty categories in, “gated” has always meant the same thing here. Pay, and you can have it. The resume PDF, the CSV of your hours, the deck without a badge — all of them sit behind a price, and the price is the answer.
Authy is the first product we have found where there is no price. Twilio’s help article does not bury this or phrase it carefully. The article’s title is “Export or Import Tokens in the Authy app Not Supported”, and the text reads: “In order to maintain security for our users, the Authy application does not allow importing or exporting 2FA account tokens.”
The consumer app is already free. There is no tier above it. So the usual question — what does it cost to get my data out — has no answer, because there is no transaction available.
We still record this as gated, because the answer to “can you export” is no. But the label in
this category’s table reads “No export, at any price”, and that distinction is the whole story.
What “no export” costs you in practice
Twilio does document a way to leave. It is not an export:
Login to the desired online account with your existing 2FA token. Disable 2FA in the app’s site. Re-enable 2FA again in the app’s site. Scan the QR code, optionally write the Authentication Key, this time on the desired 2FA App.
Read that as a unit of work. It is four steps, and they repeat per account. Someone with 2FA on their email, bank, two cloud providers, GitHub, a domain registrar and a dozen SaaS logins is looking at a full afternoon of disabling their own security and turning it back on.
The security argument for the restriction is real. A vault that cannot be exported cannot be exfiltrated by someone who gets your unlocked phone. It is a defensible trade. It is just a trade that gets made once, by the vendor, on your behalf, and you find out about it on the day you want to leave.
The three that hand it over say the quiet part in writing
What is striking about the alternatives is not that they export. It is how plainly they describe what the export contains.
2FAS: exported without a password, “the file remains unencrypted, and all data, including sensitive information like your secret keys, is readable.”
Ente: the encrypted export’s “Decrypted data format” is “otpauth://totp/…, separated by a new line” — the open standard every authenticator reads. Not a proprietary container that only Ente can open.
Aegis: “Export (plaintext or encrypted)”, listed as a feature rather than hidden in a migration guide, alongside a list of ten competitors’ formats it can import.
Three of the four here are open source, and all three export. The fourth is not, and does not. With four products that is an observation, not a law — but it is the kind of observation worth holding onto, because the mechanism is not mysterious. A project with no customers to retain has no reason to build a wall.
Export is a headline feature, in plaintext
1. Aegis Authenticator — Export is a headline feature, in plaintext
Portability documented in both directions: out, and in from ten competitors.
Best for Export listed as a feature, in plaintext, by default
From Free only. Free plan: Free and open source under GPL-3.0, confirmed against the LICENSE file in the project's own repository. There are no paid tiers..
The project's README lists "Export (plaintext or encrypted)" as a headline feature, alongside "Automatic backups of the vault to a location of your choosing." It also names the formats it can read back in: "Import from other authenticator apps: 2FAS Authenticator, Authenticator Plus, Authy, andOTP, FreeOTP, FreeOTP+, Google Authenticator, Microsoft Authenticator, Plain text, Steam, TOTP Authenticator and WinAuth (root access is required for some of these)." Export in a form a human can read, and import from ten competitors — portability is a stated feature in both directions.
Pros
- "Export (plaintext or encrypted)" is listed as a product feature, not buried in a migration guide.
- The README names ten competing apps it can import from, so portability is documented in both directions.
- GPL-3.0, confirmed by reading the repository's own LICENSE file rather than a description of it.
Skip it if
- Android only — the project describes itself as an app "for Android", with no official iOS release.
- Importing from some competitors "requires root access" by the README's own admission.
- No built-in sync: backups go "to a location of your choosing", which you have to arrange yourself.
Encrypted sync that still decrypts to an open standard
2. Ente Auth — Encrypted sync that still decrypts to an open standard
The only one here pairing end-to-end encrypted cloud sync with a documented way out.
Best for Encrypted cloud sync that still decrypts to an open standard
From Free only. Free plan: "Free and open source." The site states "Ente is fully open source. You can export and import your data. No lockins." The repository's LICENSE file is AGPL-3.0. No paid tier is offered for Auth itself..
Ente's FAQ answers the portability question directly: "Do you support exporting to Google Authenticator format? Yes, you can export your codes as HTML QR codes and then scan them in Google Authenticator to import them", via "Settings > Data > Export, Select 'Plain HTML', Acknowledge the security warning (this export is unencrypted)." The encrypted export is not a lock-in either — the migration docs state its "Decrypted data format" is "otpauth://totp/..., separated by a new line", which is the open standard every authenticator reads.
Pros
- The only product here that pairs end-to-end encrypted cloud sync with a documented unencrypted export path.
- Even the encrypted export decrypts to plain "otpauth://totp/..." lines — an open standard, not a proprietary container.
- AGPL-3.0, confirmed by reading the repository's own LICENSE file.
Skip it if
- The encrypted export needs decrypting via Ente's own app or CLI before another app can read it — two steps, not one.
- Ente flags its own portable path as a risk: "Acknowledge the security warning (this export is unencrypted)."
- No pricing page exists for Auth specifically, so there is no vendor statement that it will stay free; the only monetisation mentioned points at Ente's separate Photos product.
A JSON file with the secrets readable in a text editor
3. 2FAS — A JSON file with the secrets readable in a text editor
The most direct description of what an export actually contains.
Best for A plain JSON file with the secrets readable in a text editor
From Free only. Free plan: "It's 100% free and works offline" and "Open-source app that is and always will be free to use." No paid tier exists for 2FAS Auth; the separate 2FAS Pass password manager has its own pricing..
2FAS's own tutorial describes exactly what comes out: "these files, with the extension *.2fas, are essentially text files in JSON format." On encryption it is equally direct: "If you choose to export the file with a password, the data within will be encrypted and unreadable in a text editor. However, if exported without a password, the file remains unencrypted, and all data, including sensitive information like your secret keys, is readable." A plaintext export containing the raw secrets is available at no cost and at the user's option.
Pros
- The vendor states the export is "essentially text files in JSON format" and spells out that an unencrypted export leaves the secret keys readable.
- "100% free" with no paid tier for Auth, and the vendor commits that it "always will be free to use".
- Available on both Android and iOS, unlike Aegis.
Skip it if
- 2FAS's own pages do not document that any other app can parse a .2fas file; the evidence that one can comes from Aegis's README, which is Aegis's claim about itself, not 2FAS's.
- The support pages steer users toward password-encrypting the export and warn "the backup will be useless without it" if that password is lost.
- No pricing page for Auth itself, so there is no published plan structure to check the free commitment against.
No export, and no price that changes it
4. Twilio Authy — No export, and no price that changes it
Syncs across your devices, and stops at the edge of the product.
Best for Syncing across your own devices, and only your own devices
From Free only. Free plan: The consumer app is free — "Download our free app" and "Defeat cyber criminals & avoid account takeovers with stronger security, for free!" There is no paid consumer tier..
Twilio's help article is titled "Export or Import Tokens in the Authy app Not Supported" and states: "In order to maintain security for our users, the Authy application does not allow importing or exporting 2FA account tokens." No price unlocks it — there is no export at any tier. The only route off Authy that Twilio documents is manual re-enrolment, one account at a time: "Login to the desired online account with your existing 2FA token. Disable 2FA in the app's site. Re-enable 2FA again in the app's site. Scan the QR code, optionally write the Authentication Key, this time on the desired 2FA App." Recorded as gated because the answer to the axis question is no; unlike every other gated verdict on this site, paying does not change it.
Pros
- The consumer app is free, with no paid tier to upsell.
- Twilio's Multi-Device feature lets users "migrate tokens from one 'trusted' device to another, like when replacing an old smartphone with a new one, without having to individually reconfigure 2FA everywhere it's used" — within Authy.
- Cloud sync across a user's own trusted devices is included at no cost.
Skip it if
- Twilio states outright that "the Authy application does not allow importing or exporting 2FA account tokens" — there is no export in any format, at any price.
- The only documented way to leave is to disable and re-enable 2FA on every account individually and rescan each QR code.
- Twilio has already retired part of the product: "The Authy Desktop apps for Windows, MacOS, and Linux will now reach their End-of-Life (EOL) on March 19, 2024."
What this means if you are choosing today
If you are picking an authenticator now, this question is worth more attention than the interface. You will use the app for five seconds a day and think about it once — on the day the phone breaks, or the day you want to switch. That day is the only day the export policy matters, and it is always the wrong day to find out.
Aegis is the strongest answer on Android. Ente Auth is the strongest if you want sync across devices without giving up the exit, and it runs on more platforms. 2FAS is the most direct about what its file contains.
If you are already on Authy, nothing breaks today. But the migration cost only grows, because it scales with the number of accounts you protect. Moving twelve accounts is an evening. Moving forty is a project. The cheapest time to leave is always now.
Frequently Asked Questions
Can you export your accounts from Authy?
No. Twilio's own help article is titled "Export or Import Tokens in the Authy app Not Supported" and states: "In order to maintain security for our users, the Authy application does not allow importing or exporting 2FA account tokens." There is no paid tier that changes this, because the consumer app is already free. The restriction is a design decision, not a paywall.
How do you move off Authy then?
One account at a time, by Twilio's own instructions: "Login to the desired online account with your existing 2FA token. Disable 2FA in the app's site. Re-enable 2FA again in the app's site. Scan the QR code, optionally write the Authentication Key, this time on the desired 2FA App." If you have forty accounts protected, that is forty logins. There is no bulk path.
Which authenticator app exports your 2FA secrets?
Aegis, Ente Auth and 2FAS all do, free, and all three document it themselves. Aegis offers "Export (plaintext or encrypted)". 2FAS produces a JSON file that, exported without a password, leaves "your secret keys" readable. Ente exports either plain HTML QR codes or an encrypted file that decrypts to standard otpauth URIs.
Is a plaintext export of 2FA secrets dangerous?
Yes, and every vendor that offers one says so. Ente makes you "Acknowledge the security warning (this export is unencrypted)" and recommends deleting the file after import. 2FAS recommends exporting with a password. The risk is real, and it is a risk you can choose to take for ten minutes. The alternative is not having the option at all.
Did you install these apps and run the exports?
No. Every verdict here was read on the vendor's own documentation or the project's own repository on 6 August 2026 and is labelled as read, not run. For the open-source apps we confirmed licences by opening the LICENSE file in the project's own repository rather than trusting a description of it.
How We Keep This Updated
Prices move and vendors rewrite their plan tables, so every value on this page carries the date we read it. When a page changes, the change lands here rather than being edited away quietly. The procedure is on the methodology page. tell us and we will re-check it.
- 2026-08-06 — First published. Export policies read on each vendor's own documentation. Twilio's page renders only in a browser; a plain fetch returns nothing, so it was read with one.