Authy

Is Authy safe?

Mostly, with two catches. The codes themselves are made on your phone and, if you turn on backups, the copy Twilio stores is encrypted with a password only you know. That part is stronger than Google Authenticator, whose sync Google can read. The catches are the phone number every Authy account is built on, which leaked for about 33 million users in 2024, and the fact that you cannot take your codes with you if you leave. We score Authy 67/100, the lowest of the authenticators we cover, below Google Authenticator (74) and Microsoft Authenticator (76).

What happened in the 2024 Authy leak?

In late June 2024 the hacking group ShinyHunters posted about 33 million phone numbers tied to Authy accounts, along with account IDs. Twilio confirmed on 1 July 2024 that attackers had used "an unauthenticated endpoint" to identify data linked to Authy accounts, including phone numbers. The US vulnerability database describes the flaw, CVE-2024-39891, plainly: the endpoint accepted a stream of phone numbers and answered whether each one was registered with Authy.

Twilio said Authy accounts were not compromised and closed the endpoint. It asked everyone to update to Android 25.1.0 or iOS 26.1.0 and later. The real damage is targeting. A confirmed list of people who use two-step sign-in is useful to anyone sending fake "your Authy code" texts or trying to take over the phone number with a SIM swap.

It was the second incident in two years. In August 2022 attackers phished Twilio employees by text, got into internal tools and reached the accounts of 93 Authy users, registering extra devices on them before Twilio removed those devices. Twilio put Authy's user base at about 75 million at the time.

How Authy backups are protected

This is the strongest part of the app. When you turn on backups and pick a password, Authy derives a key from it on your phone with PBKDF2 (100,000 rounds) and encrypts each code secret with AES-256. Only the encrypted result, a salt and an IV go to Twilio, according to its own description. Twilio cannot read the secrets, and it cannot help you if you forget the password.

Restoring on a new phone works in two steps. First you prove you control the original phone number with a code by text or voice call. Then you enter the backup password. Someone who hijacks your number can pull the encrypted backup, but still needs the password to open it, so a long, unique backup password matters more here than in most apps.

Can you leave Authy?

Not easily. Twilio's help page says the app "does not allow importing or exporting 2FATwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary account tokens", for security reasons. To switch, you sign in to each site, turn two-step sign-in off, turn it on again and scan the new QR code with another app. With dozens of accounts, that is an afternoon's work.

Twilio has also cut features with short notice. In February 2024 it said the Windows, macOS and Linux apps would reach end of life on 19 March 2024, months earlier than the August 2024 date it had planned. The Authy API for businesses is closed to new customers, and Twilio points developers to its Verify product. The consumer app still gets updates (version 28.6.3 on 21 October 2026), but we would not set up a new account here today without a plan for moving out later.

What data does Authy collect?

More than the code generator itself needs. Apple's label lists coarse location, email address, phone number, user and device IDs, product interaction and diagnostics as linked to you, for analytics and app functions. There is no tracking section and no ads. Twilio's privacy notice goes further than the label: when you sign in with an Authy token it logs your IP address, the application you accessed and the time, and it records changes to your phone number and email. Twilio says it uses this to spot account takeovers.

How to use Authy safely

1. Turn on backups only with a long, unique password, and store it in a password manager. It is the only thing between a SIM-swapper and your codes.
2. Once your phones are set up, turn off the app's multi-device setting, so no new device can be added to the account.
3. Ask your mobile carrier for a SIM or port-out PIN. The 2024 list makes Authy users obvious targets.
4. Treat any text about Authy or a sign-in code as suspect. Open the site yourself instead of tapping the link.
5. For new accounts, put codes in an app that can export them, such as Proton Pass, or use a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary where the site supports one.

How we scored it

Regulatory record (88) is the best factor: we found no fine or order over either incident. Security (62) balances real end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary backups against two incidents in two years and an API that answered questions from anyone. Transparency and control (55) is the weakest, because there is no export and the desktop apps disappeared on a month's notice.