Which Authenticator Is Right for You?

Microsoft? Google? Duo? Open Source? Let’s find the right one without making your head spin!

So, you’ve read our article, “You Need a 2FA Authenticator. RIGHT NOW!” and you’re convinced. You’re ready to add another layer of protection to your online accounts. Excellent! But now you’ve opened your phone’s app store, searched for “authenticator,” and discovered approximately nine million applications claiming to be the best thing since sliced bread.

Welcome to the wonderful world of two-factor authentication!

Now, before Steve downloads the first application with a five-star rating and a picture of a padlock, let’s talk about what you actually need. Because not all authenticators are created equal, and choosing the right one doesn’t have to be complicated.

First, let’s understand what we’re looking for. An authenticator application is a program on your phone that helps verify your identity when signing into an online account. Most commonly, it generates a six-digit code that changes every thirty seconds. You enter your password, the website asks for the code, and you open your authenticator to retrieve it. Simple as that.

Some authenticators also support push notifications. Instead of typing a code, you receive a notification asking you to approve or deny a sign-in. Others support passwordless authentication, where you can sign in without entering a traditional password at all.

And here’s something that surprises a lot of people. You don’t necessarily have to use Google’s authenticator for Google, Microsoft’s authenticator for Microsoft, and another authenticator for Facebook. Many services use an industry-standard system called TOTP, which stands for Time-Based One-Time Password. That means you can often use one application to generate codes for multiple accounts.

However, some companies have their own authentication methods, particularly for push notifications and passwordless sign-ins. Those may require a specific application. We’ll talk about that in a minute.

Let’s look at some of the choices.

Microsoft Authenticator: The Familiar Choice

If you use Microsoft 365 at work, there’s a good chance you’ve already encountered Microsoft Authenticator. It’s available for Android and iPhone and supports standard verification codes, Microsoft sign-in approvals, and certain passwordless authentication methods.

One of its advantages is convenience. If your workplace uses Microsoft’s authentication services, you may already have the application installed. And yes, you can also use it to generate standard verification codes for many non-Microsoft accounts.

But there are a couple of things worth knowing. Microsoft’s backup and recovery features have platform-specific requirements, and certain work or school accounts must be registered again when you change phones. Don’t assume that restoring the application automatically restores every authentication method.

My take? If you’re already using Microsoft Authenticator and it meets your needs, there’s no reason to change just for the sake of changing.

Google Authenticator: Simple and Straightforward

Google Authenticator has been around for years, and its greatest strength is simplicity. You open the application, add an account, and it generates verification codes. No fancy interface required.

It’s available for Android and iPhone and supports standard TOTP codes for a wide variety of websites, not just Google services.

Google also offers account synchronization, allowing codes to be available on another device when you sign in with your Google account. You can also use it without syncing. One thing to understand is that Google’s authenticator synchronization isn’t the same as the end-to-end encrypted synchronization offered by some alternatives.

If you want something familiar that does the basics without a lot of extra features, Google Authenticator is a reasonable choice.

Duo Mobile: The Workplace Favorite

Now here’s one I’m particularly familiar with. Duo Mobile is widely used by businesses, universities, and other organizations to protect employee and student accounts.

If your employer uses Duo, you’ve probably seen that familiar notification asking you to approve a sign-in. Duo can make authentication very convenient because you don’t always have to type a code. You simply verify that you’re the person signing in and approve the request.

Duo Mobile can also generate standard verification codes for personal accounts such as Google, Facebook, and other services.

But here’s the important distinction. If your workplace requires Duo Push, you generally need Duo Mobile or another authentication method specifically allowed by your organization’s administrator. You can’t simply replace Duo Push with any authenticator you happen to like.

Duo also has recovery options, but restoring organization-protected accounts and restoring personal third-party codes are different processes. Make sure you understand both before changing phones.

My take? If your employer uses Duo, keep it. It does its job well, and there’s no reason you can’t use another authenticator alongside it for personal accounts if you prefer.

2FAS: The Open-Source Outlaw’s Kind of Application

Now we’re getting into territory I really enjoy.

2FAS is an authenticator available for Android and iPhone, with an emphasis on privacy, simplicity, and giving users more control over their authentication codes.

It’s free to use, offers open-source components, and doesn’t require you to create an account just to generate verification codes. It supports optional backup features using Google Drive or iCloud, along with manual exports.

One feature I particularly appreciate is the ability to export your authentication information. If you decide to change phones or move to another compatible authenticator, having a way to transfer your codes can make life much easier.

Just be careful with exported backup files. Those files can contain the secrets used to generate your authentication codes. Always protect exports with encryption and a strong password when that option is available.

My take? For the average person who wants a straightforward, privacy-conscious authenticator on Android or iPhone, 2FAS would be one of my first recommendations.

Aegis Authenticator: For the Android Crowd

If you’re an Android user and enjoy having control over your technology, Aegis deserves a serious look.

Aegis is a free, open-source authenticator that supports standard verification codes and provides encrypted storage and backup options. It’s designed around giving users control over their authentication information rather than requiring a particular online account or cloud service.

You can organize your accounts, protect access to the application, and export encrypted backups for safekeeping.

There is one limitation. Aegis is designed for Android. If you’re an iPhone user, you’ll need to look elsewhere.

And unlike some cloud-based authenticators, Aegis doesn’t automatically make your codes available on every device through its own cloud synchronization service. That’s not necessarily a disadvantage. For some people, keeping their authentication secrets under their own control is exactly the point.

My take? If you use Android and want an open-source authenticator with strong local control, Aegis is an excellent option.

Ente Auth: Open Source Across Your Devices

Here’s another one worth knowing about, especially if you use more than one device.

Ente Auth is a free, open-source authenticator available on Android, iPhone, and desktop platforms, including Linux, Windows, and macOS.

One of its biggest attractions is optional end-to-end encrypted synchronization. That means you can access your authentication codes across supported devices while keeping the synchronized information encrypted so the service provider cannot ordinarily read it.

It also supports an offline mode for people who don’t want to create an account.

For somebody who uses a desktop computer, a laptop, and a smartphone, that flexibility can be attractive. Just remember that putting authentication codes on multiple devices also means you need to keep those devices secure.

My take? If you want an open-source authenticator that works across multiple operating systems, Ente Auth deserves a look.

So Which One Should You Choose?

Here’s how I would approach it. If your workplace requires Microsoft Authenticator or Duo Mobile, use the application your organization supports. If you’re looking for a simple authenticator for personal accounts, Google Authenticator or 2FAS can do the job. If you’re an Android user who wants maximum local control, consider Aegis. And if you want open-source authentication codes available across your phone and computers, take a look at Ente Auth.

There isn’t one perfect authenticator for everybody.

And remember, the best authenticator in the world won’t help you if you never enable two-factor authentication on your accounts.

Okay, Outlaw. I’ve Picked One. Now What?

Here’s where things get surprisingly easy.

Start by installing your chosen authenticator from the official app store or the developer’s official website. Be careful here. There are imitation applications out there, and security software is not something you want to download from a random website.

Once you’ve installed the application, open the security settings for an account you want to protect. I recommend starting with your primary email account.

Look for a setting called Two-Factor Authentication, Two-Step Verification, or Multi-Factor Authentication. The exact wording depends on the service.

Choose the option for an authenticator application, if one is available. The website will usually display a QR code.

Open your authenticator, choose the option to add an account, and scan the QR code. Your authenticator should begin generating a verification code. Enter that code on the website to complete the setup.

Congratulations! You’ve just added another layer of protection to your account.

One important warning: that setup QR code contains sensitive information. Don’t share it, photograph it for social media, or leave it somewhere other people can access it.

And before you close the website, there’s one more thing you absolutely need to do.

SAVE THOSE RECOVERY CODES!

Many services give you a collection of recovery codes when you enable two-factor authentication. These are emergency codes you can use if you lose access to your authenticator.

Please don’t skip this step.

Phones get lost. Phones break. People buy new phones. Sometimes people accidentally delete applications. It happens.

Without a recovery method, you could find yourself locked out of an account you’re trying to protect.

Store those recovery codes securely, preferably somewhere separate from your phone. An encrypted password manager or a securely stored printed copy can work well. And if your authenticator supports encrypted backups, learn how to use them before you need them.

One More Thing: Don’t Just Approve Everything!

Now that you’ve got an authenticator, let’s talk about something important.

If you use an authenticator that sends push notifications, never approve a sign-in request you didn’t initiate.

Sometimes attackers repeatedly send authentication requests hoping you’ll eventually approve one just to make the notifications stop. That’s called MFA fatigue, and it’s a real problem.

If your phone suddenly asks you to approve a sign-in and you’re not trying to sign in anywhere, deny it. Then check the account through its official website or application.

And NEVER give an authentication code to somebody who calls, emails, or texts asking for it. Not somebody claiming to be from Microsoft. Not somebody claiming to be from your bank. Not somebody claiming to be from the help desk.

If you didn’t initiate the sign-in, don’t provide the code.

Also remember that ordinary six-digit codes can still be stolen through convincing phishing websites. Where available, passkeys and hardware security keys offer stronger protection against many of those attacks. An authenticator is a major improvement over a password alone, but it isn’t a reason to stop being careful.

The Outlaw’s Final Word

Look, I’m not trying to turn everybody into a cybersecurity professional. I just want people to understand that protecting their digital lives doesn’t have to be complicated or expensive.

Most of the authenticators we’ve discussed are free. Most take only a few minutes to install. And once they’re configured, using them becomes part of your normal routine.

You don’t need to understand cryptography. You don’t need a degree in computer science. And you certainly don’t need Steve standing over your shoulder explaining how many bits of entropy are in your password.

You just need to take that first step.

Choose an authenticator. Install it. Protect your email. Then work your way through your other important accounts.

And while you’re at it, make sure you have a way to recover those accounts if your phone ever goes missing.

Because protecting your accounts is important.

But being able to get back into them is pretty important, too!

If you haven’t already read our companion Blog article, “You Need a 2FA Authenticator. RIGHT NOW!”, check it out. It explains why this simple step is one of the most important things you can do to protect your online life.

Until next time, don’t be a Steve.

The Open Source Outlaw