Aegis Authenticator is a free, open-source OTP app for Android. It keeps authenticator entries in a local vault, supports password and biometric unlocking for encrypted vaults, and can create encrypted exports and automatic backups. That combination gives Android users strong control over portability without requiring an Aegis account or an Aegis-operated synchronization service.
Correction published August 30, 2026: The previous edition presented this as a hands-on test, assigned an unsupported numerical rating, and displayed generated product-interface images without supporting test evidence. It also said every vault was necessarily encrypted, contradicted itself about automatic backups, overstated unlock options and code review, and included outdated competitor information. This revision removes those claims and images. It distinguishes optional vault encryption from plaintext storage, explains the actual backup model, and relies on the project’s documentation, current store listing, and release record.
Short verdict: Aegis is a strong fit for Android users who want an inspectable, locally controlled authenticator with encrypted file backups. It is a poor fit for people who need iPhone, desktop, browser-extension, or built-in multi-device synchronization. Like every manually entered OTP app, it improves on password-only login but is not phishing-resistant.
What Aegis officially supports in 2026
The project’s official repository describes Aegis as a free, GPLv3-licensed authenticator for Android. It supports the standard HOTP and TOTP algorithms used by services that accept Google Authenticator-compatible codes. Entries can be added by scanning a QR code or an image, entering details manually, importing an otpauth URI, or using supported import formats.
Aegis also offers practical organization features: alphabetical or custom sorting, custom or generated icons, groups, search by name or issuer, and list or tile-oriented presentation. Screen-capture prevention and tap-to-reveal are documented privacy controls. These features help when a vault grows beyond a few accounts, but they do not change the security properties of OTP itself.
The current v3.4.2 release was published on February 24, 2026. It added clipboard import for otpauth URIs, redesigned the add-entry menu, and fixed an Android 16 quick-settings tile problem. Google Play lists the same February 24 update date.
Aegis remains Android-only. The project’s FAQ says there are no plans for iOS, Windows, macOS, or a browser extension. Chromebook availability through Google Play should not be confused with native desktop support or a synchronized desktop vault.
Vault encryption: the precise security model
Aegis stores token secrets and related metadata in a JSON vault. The important qualification is that the vault specification allows either plaintext storage or password-protected encryption. Encryption is strongly advisable, but it is a configuration choice rather than an unconditional property of every vault.
For an encrypted vault, Aegis generates a random 256-bit master key and protects the vault contents with AES-256 in GCM mode. GCM is an authenticated-encryption mode, so encrypted contents receive confidentiality and integrity protection. A password credential is processed with scrypt to derive the key used to unwrap the master key.
Biometric unlocking adds a separate credential slot backed by Android Keystore. The biometric itself does not replace encryption or become the vault password. Android permits the Keystore-backed key to be used after successful biometric authentication. The project warns that device security changes or buggy vendor implementations can interrupt biometric unlock; the password remains the recovery credential.
This design is more useful than an unsupported security superlative. It also exposes an important operational rule: the master key is only as secure as the weakest enabled credential. Use a unique vault password, keep the password reminder enabled, and do not depend on biometrics as the only way back into the vault.
Privacy and network behavior
Aegis’s official FAQ says the app does not have internet access and that the developers do not plan to add it. As a result, Aegis cannot send a vault directly to a proprietary Aegis cloud service, fetch account icons from a server, or independently synchronize phones.
The current Google Play listing carries the developer’s declarations that no data is collected and no data is shared with third parties. Store data-safety labels are developer-supplied declarations, not a substitute for a code audit, but the open repository and lack of internet access make the architecture more inspectable than a closed client with an undisclosed backend.
“Local-first” does not mean risk-free. Malware, a compromised Android device, an exposed plaintext export, a weak vault password, or a lost phone without a usable backup can still defeat the recovery plan. Open source also means the code can be inspected; it does not by itself prove that every release is free of vulnerabilities or has been independently audited.
The repository publishes signing-certificate fingerprints and says Google Play and GitHub APK releases use the same signing key. Advanced users who install APKs outside Google Play can verify signatures with Android’s apksigner, but most users should install from the official Google Play or F-Droid links and avoid third-party APK sites.
Backups and exports are local workflows, not built-in sync
Aegis separates exports from backups. According to the project’s FAQ, an export is started manually, while a backup is created automatically. Both use the same Aegis vault file format.
Automatic backups require an encrypted vault. Aegis writes backup files to a location chosen through Android’s storage framework when the vault changes. The app does not upload them itself. If a cloud-provider app fully supports Android’s Storage Access Framework, Aegis may be able to write into a provider-backed location; the FAQ identifies Nextcloud as a known example. Another documented approach is writing to local storage and letting a separate tool such as Syncthing copy the folder elsewhere.
Encrypted exports use the same vault password configured for the encrypted vault. Plaintext export is also supported, but it exposes the OTP secrets and should be treated like a file containing reusable passwords. Do not email it, leave it in Downloads, or upload it without a separate encrypted container.
The practical recovery model therefore has three parts: an encrypted Aegis vault file stored away from the phone, the password needed to open it, and each website’s independent recovery codes. Keep those parts in separate protected locations. A backup that exists only on the same phone does not protect against loss, theft, hardware failure, or a destructive reset.
Migration and day-to-day use
Aegis documents import support for Google Authenticator, 2FAS, Authy, andOTP, FreeOTP variants, Microsoft Authenticator, Steam, WinAuth, plain text, and several other formats. That list does not promise a one-click migration from every installed app. The source app must provide a usable export, or root access may be required for formats that cannot otherwise be exported.
Avoid unsupported extraction tools for live accounts. A safer migration sequence is to use the source authenticator’s documented export when available. When it is not available, visit each service’s security settings, register Aegis as a replacement authenticator, verify a new code, save fresh recovery codes, and only then remove the old registration.
For a new account, scan the service’s setup QR code or enter its secret manually. Confirm a code in the service before leaving setup. Never capture a live enrollment QR code in an ordinary screenshot because the QR contains the reusable seed from which future codes are generated.
Groups, icons, sorting, and search are useful after migration. They are organizational metadata inside the vault, not additional authentication factors. Use unambiguous issuer and account labels so that similar accounts are not confused during a time-sensitive login.
Security limits: Aegis does not stop real-time phishing
Aegis protects stored OTP seeds when the encrypted vault is locked and keeps normal operation local. It cannot tell whether the website asking for a six-digit code is genuine.
NIST’s current authenticator guidance states that manually entered OTP methods are not phishing-resistant. An attacker-controlled page can capture a fresh code and immediately relay it to the real service. TOTP also depends on correct device time, while HOTP depends on the service and app counters staying aligned.
Use Aegis when OTP is the strongest method a service offers or when portability and local control matter. Prefer a passkey or FIDO2 security key where phishing resistance is available. Keep OTP as a fallback only when the service’s recovery design requires it, and protect the email account that controls password resets with the strongest available factor.
Who should choose Aegis
Aegis makes sense when all of these conditions are acceptable:
- The primary device is Android.
- The user wants open-source code and a vault stored under local control.
- Encrypted file exports and automatic local backups are preferable to account-based sync.
- The user is willing to maintain and periodically restore-test a backup.
Choose another authenticator when iOS, desktop access, a browser companion, or automatic account-based synchronization is essential. Those alternatives introduce different trust and recovery trade-offs; “cloud” and “encrypted” are not enough information on their own. Verify whether the provider can read synchronized secrets, whether an independent export exists, and what happens after a lost device.
Our source-verified 2FA authenticator comparison covers Aegis alongside current cross-platform choices. Do not switch merely to chase a feature score. A working recovery path and a successfully rehearsed migration matter more than the number of settings in the app.
Aegis setup and recovery checklist
- Install Aegis from its official Google Play or F-Droid listing.
- Create an encrypted vault with a unique, memorable password.
- Enable biometric unlock only after confirming the password works.
- Keep the password reminder enabled so the password is not forgotten.
- Add one noncritical account and complete a signed-out login test.
- Save the service’s recovery codes outside the Aegis vault.
- Configure automatic backups to a location that survives phone loss.
- Create a separate encrypted export and move it off the phone.
- Restore that export on a controlled device before migrating critical accounts.
- Move email, password-manager, registrar, financial, and developer accounts one at a time.
- Delete any plaintext exports immediately after a confirmed migration.
- Prefer passkeys or security keys for services that support phishing-resistant login.
Revisit the backup after adding or removing important accounts. A recovery test is the only reliable way to know that the file, password, storage destination, and restore procedure still work together.
Aegis Authenticator verdict
Aegis is one of the clearest options for an Android user who wants an open-source authenticator, an encrypted local vault, and portable encrypted backups without an app-operated sync account. Its documented cryptographic design and lack of internet access make the trust boundary unusually visible.
The trade-off is operational responsibility. Aegis has no official iOS or desktop client, and its storage-provider integration is a file-backup workflow rather than seamless multi-device synchronization. A forgotten vault password or an untested backup can create the same lockout that local control was meant to prevent.
Use Aegis with an encrypted vault, a strong password, an off-device backup, and separate service recovery codes. That is a defensible recommendation supported by the current documentation; a numerical score or invented hands-on narrative would not improve it.
Frequently asked questions
Is Aegis available for iPhone or desktop?
No. The official FAQ says the project has no plans for iOS, Windows, macOS, or a browser extension. Aegis is an Android app.
Is every Aegis vault encrypted?
No. The vault specification permits plaintext or password-encrypted storage. Users should create an encrypted vault; automatic backups are available only for encrypted vaults.
Does Aegis provide cloud sync?
No Aegis-operated sync service is documented. Aegis can automatically write backup files to locations exposed through Android’s Storage Access Framework, including a compatible cloud-provider app, but that is file backup rather than account-based synchronization.
Can Aegis use biometric unlock?
Yes. An encrypted vault can add a biometric credential backed by Android Keystore. Keep the vault password available because device security changes or implementation problems can disable biometric access.
Can Aegis import Google Authenticator accounts?
The project lists Google Authenticator among supported imports. Migration still depends on obtaining a supported export from the source app. Verify every moved account before deleting the old authenticator.
Is Aegis phishing-resistant?
No. Codes manually entered into a login page can be relayed by a phishing site. Passkeys and FIDO2 security keys provide a stronger phishing-resistant option where supported.
