Back to catalog
Aegis Authenticator
GPL-3.0Aegis Authenticator is an open-source Android 2FA app that replaces Authy with encrypted local vaults, biometric unlock, and offline backup control.
Open-source alternative to — compare it against:
Overview
Beem Development created Aegis Authenticator to provide Android users with transparent vault encryption, unconstrained backups, and zero reliance on proprietary cloud services. Built in response to commercial token generators that locked credentials behind closed accounts, the project established a standalone vault architecture for multi-factor secrets. Today, that origin ensures developers and engineers keep complete custody of their infrastructure seeds.
Why Aegis Authenticator instead of Authy
Authy couples two-factor authentication to Twilio's cloud infrastructure, requiring a telephone number and routing token synchronization through remote servers. That architecture provides multi-device convenience, but introduces significant integration hazards: Twilio dropped its desktop client, locks seeds inside a database with no export feature, and suffered security breaches exposing phone numbers. Aegis Authenticator adheres strictly to open standards, generating RFC 6238 time-based (TOTP) and RFC 4226 counter-based (HOTP) tokens across SHA-1, SHA-256, and SHA-512 algorithms for services like AWS, GitHub, and Cloudflare.
Where Authy relies on a proprietary backend, Aegis connects directly to Android subsystems. Operating without network permissions ensures that secrets never leak over local interfaces. Vault synchronization uses Android's Storage Access Framework, allowing engineers to pipe automated encrypted backups to self-hosted Nextcloud or Syncthing shares. Aegis also ensures data portability: it imports existing databases from Authy, Google Authenticator, and Steam, while exporting plaintext or encrypted JSON vaults for scriptable recovery.
What it does well
- Standard TOTP and HOTP support across SHA-1, SHA-256, and SHA-512 algorithms, providing broad compatibility with cloud consoles, code repositories, and legacy tokens.
- Zero network permissions on Android, guaranteeing that seed secrets and timestamps never transmit across the internet.
- Authenticated vault encryption using AES-256-GCM with keys derived via scrypt, unlocked through Android Keystore biometrics or a passphrase.
- Automated scheduled backups through Android Storage Access Framework, enabling unattended sync to self-hosted Nextcloud storage or Syncthing shares.
- Import tools that ingest token databases from Authy, Google Authenticator, Microsoft Authenticator, and Steam without manual QR scanning.
