2FAS Auth

Is 2FAS safe?

Yes. 2FAS Auth is about as private as an authenticator gets: no account, no email, and an App Store label that lists only crash data not linked to you. Google Play goes further and declares that the app collects nothing. The code is open source and we found no breach. We score it 83/100, ahead of Google Authenticator (74) and Authy (67) but behind Proton Authenticator and Ente Auth (87 each). The gaps are an Android cloud backup that 2FAS does not encrypt unless you add a password, and no independent audit or paid bug bounty to back up the company's security claims.

What does 2FAS collect?

Very little. The 2FAS Auth privacy policy, updated on 27 June 2025, says all authentication data stays on your device and is "never transmitted to our servers". It lists what 2FAS does not collect: your tokens or secrets, usage analytics, tracking IDs and advertising data. The one thing it does gather by default is crash reports through Google's Firebase Crashlytics, and the support page says you can switch those off with a toggle in the app's settings. If you turn on push notifications for the browser extension, some technical data passes through Firebase too.

There is a catch in the paperwork. The privacy policy that both the App Store and Google Play link to is not the 2025 app policy but an older 2FAS policy from August 2022. That one says 2FAS collects and stores your device ID, including brand, model and a unique ID, and uses cookies and Google Analytics. The 2025 policy matches the store labels better, but when two policies disagree, we score the broader one.

How safe are 2FAS backups?

That depends on your phone and one setting. On iPhone, backup to iCloud switches on by default when you are signed in to iCloud; on Android you turn on Google Drive sync yourself. 2FAS's help pages say cloud sync is end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary by default with AES-GCM, on top of Apple's or Google's protection.

The open-source code tells a more mixed story. On iPhone, the app creates a random key and keeps it in iCloud Keychain, which Apple encrypts end to end, so the default backup is well protected. On Android, the code only encrypts the Google Drive backup when you set a backup password; without one, your code secrets sit in a hidden Drive folder protected only by your Google account. 2FAS recommends the password and warns that it cannot be recovered. We would treat it as required.

Sync also stays inside one platform. iCloud backups restore to iPhones and Google Drive backups to Android phones. To switch between the two, you export a .2fas file and import it on the other phone, again with a password.

The browser extension

The extension is what sets 2FAS apart. When a site asks for a code, you click the extension, your phone shows a request, and if you approve, the code is sent encrypted to the browser and filled in. 2FAS says the link uses RSA-OAEP with SHA-512.

The trade-off is the browser permission to "read and change all your data" on websites, which the extension needs to find the code box on any site. 2FAS points to its open-source code so you can check what the extension does. That permission is normal for autofill tools, but it means a fake copy in a browser store, or a compromised update, would see a lot. Install it only from the link on 2fas.com.

Who checks the code?

The iOS, Android and browser extension code has been public under the GPL-3.0 licence since 2022, and the iOS repository was updated on 26 October 2026. That lets anyone read it. We found no published independent security audit of 2FAS Auth, and the company's About page does not mention one.

2FAS has a vulnerability disclosure policy: researchers email [email protected], with a PGP key, and the company promises a reply within 72 hours under coordinated disclosure. We found no program on HackerOne, Bugcrowd or Intigriti and no mention of rewards. Proton and Ente, by contrast, have outside audits or a paid bounty behind their authenticators.

How to use 2FAS safely

1. Set a backup password in the 2FAS Backup settings, and store it in your password manager. Without it you lose an extra lock; with it forgotten you lose the backup.
2. Every few months, export a password-protected .2fas file to a computer or USB stick, as 2FAS itself suggests.
3. Turn on the app's PIN or biometric lock so a borrowed, unlocked phone does not show your codes.
4. If you use the browser extension, pair only browsers you own and remove old pairings when you change computers.
5. Never type a code into a page you reached from a text or email link.

How we scored it

Privacy (88) is the strongest factor: no account and the shortest labels in both stores, held back only by the outdated 2022 policy the stores still link. Security (76) is the weakest, because Android backups are unencrypted without a password and there is no published audit or paid bug bounty to test 2FAS's encryption claims. The regulatory record (87) is clean but rests on a small company that no regulator has examined. Users who want audited, end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary sync by default can look at Ente Auth.