Proton Authenticator

Is Proton Authenticator safe?

Yes. Proton Authenticator does one job, making six-digit sign-in codes, and it does it without asking who you are. You can use it with no account at all, Apple's privacy label lists only crash and diagnostic data that is not linked to you, and if you do sync, the codes are encrypted on your phone before they reach Proton. We score it 87/100, a point behind Bitwarden (88), level with Ente Auth and well ahead of Google Authenticator (74). What holds it back is age: the app launched on 31 July 2025, it has no published independent audit, and its first iOS release had a logging bug that exposed code secrets on the device.

How is Proton Authenticator sync encrypted?

End to end, according to Proton's security model, written by Carlos Quintana and published in October 2025. When you turn on sync, the app creates a random 32-byte key for your codes, encrypts and signs it with your Proton user key, and uses it to encrypt every entry with AES-256-GCM. Your user key is protected by a bcrypt hash of your Proton password. Proton says this means it "never" has access to your unencrypted data and cannot see which online services you hold accounts with.

That is the main difference from Google Authenticator, whose sync to a Google account is encrypted only in transit and at rest with keys Google holds. It is closer to Authy's password-protected backups, without Authy's phone number requirement.

On the device, codes are encrypted with a local key that sits in the iPhone and Mac Keychain, the Android Keystore, Windows Credential Manager or the Linux Secret Service. If a Windows or Linux machine has no such store, the app lets you protect the key with a password instead.

The August 2025 logging bug

Within days of launch, a Reddit user found full TOTP secrets in plain text in the iOS app's debug log under Settings. The secret is the seed that every future code is made from, so anyone who sees it can make your codes.

Proton changed the logging and shipped version 1.1.1 to the App Store on 4 August 2025, BleepingComputer reported. Proton said the logs are local only and never sent to its servers, and that the flaw could not be exploited remotely. The real risk was sharing a log file with support or on a forum. The same user also reported that some codes vanished after editing a label; neither BleepingComputer nor Proton linked that to the log bug, and we found no further reports.

It was a beginner's mistake, caught and fixed within days. It is also the reason we would like to see the independent audit Proton has promised.

What has been audited, and what has not

Proton's open-source page lists audit reports for Mail, Calendar, Drive, VPN and Pass. Proton Authenticator appears there with links to its GitHub code only. The security model says the app "will also undergo regular independent security audits" and that the reports will be public as soon as they exist. We found none as of 27 October 2026.

What the app does have is open code under the GPL-3.0 licence, for iOS and Android, and a place in Proton's bug bounty, which Proton says pays up to US$100,000. Outside researchers can read exactly how codes are stored and synced. That is better than closed apps such as Google's or Microsoft's, but it is not the same as a firm being paid to look.

Can you back up and leave Proton Authenticator?

Yes, and this is where it beats the older apps. The export screen offers to protect the file with a password, with a "without password" option for people who need a plain file. Backups go to iCloud on Apple devices. On Android you can turn on automatic backups to a folder you choose, daily, weekly or monthly, with their own password. Proton says the security model encrypts these backups with a key derived from your password using Argon2, and that they can be opened without the app using standard tools.

Coming in is easy too. Proton's FAQ lists imports from Google Authenticator, 2FAS, Aegis, Bitwarden Authenticator, Ente Auth and LastPass Authenticator. Authy and Microsoft Authenticator do not export, so codes from those apps have to be re-enrolled site by site.

How to use Proton Authenticator safely

1. Decide how you will recover. Either sign in to a Proton account with a strong password and its own second factor, or keep a password-protected export somewhere off the phone.
2. Always set a password on exports. A plain export file is every second factor you own in one place.
3. Keep the app updated, and do not attach debug logs to support emails or forum posts.
4. Turn on the biometric or PIN lock in settings, so someone holding your unlocked phone cannot read codes.
5. Never type a code into a page you reached from a text or email link. Phishing kits relay codes within seconds.
6. For your email and main Proton account, add a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary or security key where you can.

How we scored it

Privacy (91) is the strongest factor: no account needed and an almost empty privacy label. The regulatory record (88) is clean, but a 15-month-old app that no regulator has examined stays below the 90+ band of Proton's older apps. Security (84) is the weakest, held back by the missing independent audit and the 2025 iOS logging bug, against end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary sync and open code. If Proton publishes a clean audit, the score would move up.