Aegis Authenticator

Is Aegis Authenticator safe?

Yes. Aegis is one of the most private authenticator apps you can install, for a simple reason: it cannot connect to the internet. The Android app does not request the internet permission, Google Play lists no data collected or shared, and its privacy policy is one sentence saying it collects nothing. Your codes sit in an encrypted file on the phone. We score it 87/100, level with Ente Auth and Proton Authenticator and well ahead of Google Authenticator (74).

The catches are about proof and reach. Nobody has published an independent audit of Aegis, there is no paid bug bounty, and in September 2026 the developers fixed a high-severity flaw in how it imports icon packs. It also runs only on Android.

What does Aegis collect?

Nothing, and here the claim is easy to check. Aegis's Android manifest, the file that lists what the app may do, asks for the camera (to scan QR codes), biometrics, vibration, notifications and permission to run at start-up. Internet access is not on the list. The developers' FAQ says "Aegis doesn't have access to the internet", and they have no plans to change that.

That makes Aegis different from most authenticators we score. 2FAS collects crash reports, Google Authenticator syncs to a Google account without end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, and even privacy-focused apps such as Ente Auth and Proton Authenticator need servers to sync. Aegis has no account, no server and no analytics. The app is free, has no ads, and is built by Beem Development, a small team in Dordrecht in the Netherlands.

How is the vault protected?

Aegis stores your secrets in a single file it calls the vault. Its published security design explains the choices: the vault is encrypted with AES-256 in GCM mode, using a random master key. That key is unlocked by a key derived from your password with scrypt, using the same settings Android uses for disk encryption. You can add fingerprint or face unlock, which uses a key held in Android's hardware-backed Keystore. The document is unusually frank about limits, noting that newer options such as Argon2 "will be considered" in the future.

Two settings matter. First, encryption is a choice when you set up the app, and Aegis lets you keep the vault in plain text. Do not. Second, exports can also be plain text. Aegis encrypts exports and backups with your vault password if the vault is encrypted, so the safe path is the default one if you set a password at the start.

The September 2026 flaw shows where the risk is. Advisory GHSA-fw8c-jmjv-q6xf, rated high, says a specially crafted icon pack could overwrite the app's internal files, including the vault, if you imported it. An attacker would have to talk you into installing the pack. Version 3.4.3, released on 6 September 2026, fixed it.

Backups without the internet

Because Aegis cannot upload anything, backups are your job. The app can save automatic backups to a folder you pick. If a cloud app such as Nextcloud supports Android's file-access system, that folder can be in the cloud; otherwise a sync tool like Syncthing can copy it elsewhere. Aegis can also join Android's own cloud backup, but only for encrypted vaults.

The upside is that no company holds your codes. The downside is that if your phone dies and you never set up a backup, the codes are gone and you must recover each account through its own reset process.

Who checks the code?

Aegis has been open source under the GPL-3.0 licence since 2016, and anyone can read the code and the security design. The project has about 13,400 stars on GitHub, and the team publishes advisories when it fixes flaws. We found no independent audit and no paid bug bounty. That is the main reason security scores 80, below Ente Auth (87), which has a Cure53 audit, and Proton Authenticator (84), which a paid bug bounty covers.

How to use Aegis safely

1. Set a strong vault password at setup and keep it in your password manager. Without it, the vault and every backup are lost.
2. Turn on automatic backups to a folder that is copied off the phone, and test a restore once.
3. Install Aegis only from Google Play, F-Droid or the project's GitHub page. There is no official iPhone app.
4. Import icon packs only from sources you trust, and update to version 3.4.3 or later.
5. Never type a code into a page you reached from an email or text link. An authenticator cannot stop real-time phishing.

How we scored it

Privacy (95) is the highest we give an authenticator: no data, no account and no internet access at all. Security (80) is strong on design but loses points for optional encryption, no audit or bounty, and the 2026 icon-pack flaw. The regulatory record (87) is clean, but no regulator has examined a niche app like this. iPhone users who want something similar can look at Ente Auth, which adds audited, end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary sync.