Authy vs Yubico Authenticator

Authy is a free two-factor authentication app for Android and iOS that generates TOTP codes for online accounts. Users can scan QR codes from services including Facebook, Amazon, Google, Microsoft and Dropbox, then access tokens on a phone, tablet or Apple Watch. Codes are generated on the device, so a phone does not need an internet connection to access secured websites. Authy supports encrypted backups and synchronization across multiple devices. Access to tokens can be protected with Touch ID, a PIN or a password. New devices can be added through SMS, voice or approval from an existing device; users can also rename or remove lost or stolen devices and disable future app installations. Authy says it encrypts authentication data and cloud backups without retaining users’ backup passwords. That means a forgotten backup password cannot be recovered through Authy. Its listed free plan costs nothing and includes two-factor authentication, encrypted cloud backup and multi-device support.

Yubico Authenticator generates two-step verification codes for online accounts on mobile and desktop devices. It supports TOTP and HOTP, and users can add credentials by scanning a service’s QR code. Credentials are stored in a YubiKey secure element; Yubico says they cannot be extracted. Since the credentials remain on the portable YubiKey, the same codes are available through the mobile and desktop apps. The mobile app supports tap-and-go authentication on NFC-enabled devices, and credentials can be added with a YubiKey touch or NFC tap. Yubico says users can unlock a YubiKey with Face ID or Touch ID. The app can display OATH codes and manage a YubiKey’s FIDO PIN or perform a factory reset. It is free and open-source software, listed at free, for Windows, macOS, Linux, iOS/iPadOS, and Android. Generating and displaying OATH credentials with the desktop app requires a YubiKey.