Aegis Authenticator

Two-step verification codes protect accounts, but the app that holds them becomes a single point of failure. Lose the phone without a backup and you can lose access to every service tied to it. Leave the codes in a store you cannot inspect and you depend on someone else's promises.

Aegis addresses both worries. The source code is public on GitHub under the GPL-3.0-only licence, so anyone can read how the vault works. It supports the HOTP and TOTP algorithms, and the developer states that any service that works with Google Authenticator will also work here.

The app first shipped on March 28, 2019, and the latest build in our catalog was updated on September 9, 2026. That span matters for a security tool, because it shows the project has been maintained for years rather than published once and left alone.

All tokens live in a single vault. If you set a password, the vault is encrypted, and the developer notes that a copied vault file cannot be read without that password. Typing a password for every code gets tedious, so you can switch on biometric unlock when the device has a fingerprint or face sensor.

Other protections are listed in the feature overview: screen capture prevention and tap to reveal, which hides codes until you choose to show one. Appearance is handled with a Material design and Light, Dark and AMOLED themes.

Adding entries works in several ways. You can scan a QR code, scan an image of one, or type the details by hand. Organisation tools include alphabetic or custom sorting, custom or generated icons, groups such as Personal, Work and Social, advanced entry editing, and search by account or issuer name.

Backups are the part that answers the lost-phone problem. Aegis can write automatic vault backups to a location you pick, including cloud storage if the provider supports the Android Storage Access Framework, with Nextcloud given as an example. Manual exports are also available, either in plaintext or encrypted form.

Switching is covered by an import function. The developer lists 2FAS Authenticator, Authenticator Plus, Authy, andOTP, FreeOTP, FreeOTP+, Google Authenticator, Microsoft Authenticator, Steam, TOTP Authenticator and WinAuth as sources. Apps that have no export option need root access before Aegis can read their entries, which is a real hurdle for most people.

Before installing, confirm that the phone runs Android 6.0 or later. Decide on a vault password at setup, since the developer recommends one and encryption depends on it. Pick a backup location early, because Aegis does not sync to the cloud by default.

Also be careful with plaintext export. It is useful for migration, but a plaintext file holds every token in readable form, so the encrypted option is the safer default. Compare the checksum on this page with your downloaded file, and keep old authenticator entries until you have confirmed the new codes work on each account.

We host the unmodified APK as a Tier A file, with the SHA-256 checksum 0eecec45de0da3ff1358004b51e2960d9178551643a6ed44f6496ea9ec999c19 for verification. The app is published by Beem Development under the GPL-3.0-only licence, and its source is public on GitHub. The app shows no ads. Protection of your tokens still depends on setting a vault password and keeping backups.