Authy vs Bitwarden

Authy is a free two-factor authentication app for Android and iOS that generates TOTP codes for online accounts. Users can scan QR codes from services including Facebook, Amazon, Google, Microsoft and Dropbox, then access tokens on a phone, tablet or Apple Watch. Codes are generated on the device, so a phone does not need an internet connection to access secured websites. Authy supports encrypted backups and synchronization across multiple devices. Access to tokens can be protected with Touch ID, a PIN or a password. New devices can be added through SMS, voice or approval from an existing device; users can also rename or remove lost or stolen devices and disable future app installations. Authy says it encrypts authentication data and cloud backups without retaining users’ backup passwords. That means a forgotten backup password cannot be recovered through Authy. Its listed free plan costs nothing and includes two-factor authentication, encrypted cloud backup and multi-device support.

Bitwarden is a password manager for individuals and organizations to manage and share online information. Accounts can store passwords, notes, credit cards, and identities, and include passkey management plus a username and password generator. Bitwarden says vault data is end-to-end encrypted and only the user's master password can decrypt it. Bitwarden Send transmits text and files to anyone, including people who do not use the service. Apps include a web app, browser extensions, desktop applications for Windows, macOS, and Linux, and mobile apps for Apple and Android. The Free plan includes basic password management, unlimited devices and passwords, and sharing with another user at no charge. Premium is $1.65 a month billed annually; Families is $3.99 a month billed annually for up to six users. Teams costs $4 per user per month billed annually, and Enterprise is $6 per user per month billed annually. The company says it conducts annual source code audits and penetration tests, and lists ISO 27001, SOC 2, SOC 3, and HIPAA credentials. One platform-specific limitation: the F-Droid build lacks live-sync push notifications, so manual vault syncing is required.