Ente Auth

Aegis locks secrets to a single Android phone — secure, but inconvenient when you are signing into something on a computer and have to reach for the phone. Ente Auth takes the other route: sync, with end-to-end encryption ensuring the server cannot see anything.

The mechanism: secrets are encrypted on your device before upload, so Ente's servers hold only ciphertext that is useless without your password. A new phone or an extra computer restores every code by signing in — cloud convenience without handing plaintext secrets to a vendor.

Platform coverage is its strongest suit: Android, iOS, Windows, macOS, Linux and web. Signing into a site on your computer means copying the code from the desktop app rather than picking up your phone, and that difference is noticeable every single day.

It also displays existing codes offline (sync exists only for cross-device use), imports from Google Authenticator, Authy, 2FAS and Aegis, and exports in plain or encrypted form. If you do not trust its servers, the server code is AGPL and you can deploy your own.

To be clear about:

• An Ente account is required. That is inherent to a sync solution, which is why it carries no no-sign-up badge. If you want no account at all, Aegis on Android is the purer choice.
• Lose the master password and nobody can help you. The flip side of end-to-end encryption is that the vendor cannot decrypt your data either. Write the recovery key down and store it separately.
• Ente the company also sells a paid encrypted photo product, but the Auth app is free — no cap on codes, no device limit, no feature wall. That free app is what we list here.

How to choose: Android-only and want maximum simplicity, take Aegis; multiple devices and codes needed on a computer, take Ente Auth. Both are open source and both are cleaner than a vendor-custodied service.