Aegis Authenticator

What Is Aegis Authenticator?

Losing access to an account because your 2FA app didn’t back up properly is a uniquely annoying kind of “security feature.” Aegis is built for people who want strong two-factor authentication without handing their OTP secrets to a vendor cloud or creating an account just to move codes between phones.

It’s an Android authenticator that generates one-time passwords for logins (the same 6‑digit style codes you’d get from Google Authenticator, Authy, etc.), but with a clear focus on local security: your secrets live in an encrypted on-device “vault,” and backups are something you control. The app is free, open source, and distributed via both Google Play and F-Droid, with its source code published on GitHub.

What makes it distinctive is the combination of (1) an encrypted vault by design, (2) import tools meant to help you leave proprietary authenticators, and (3) a model that doesn’t rely on Aegis-operated servers for sync. That’s a trade-off—less convenience, more user responsibility—but it’s exactly what many privacy-minded users want.

Aegis Authenticator Features and Performance

Aegis supports the two mainstream OTP modes you’ll encounter in the real world: TOTP (time-based codes) and HOTP (counter-based codes). That alone covers “thousands of services,” which is the practical baseline for an authenticator app.

Encrypted vault (and how it’s implemented)

Aegis stores tokens in an on-device vault that can be encrypted using AES-256-GCM. The project documentation and repository describe a design where a master key encrypts the vault contents, and that master key is protected via “slots” (unlock methods) that encrypt the master key using AES-256-GCM as well.

On unlock methods, Aegis supports password-based unlock and biometric unlock (using Android’s platform mechanisms). Third-party summaries and project-oriented documentation consistently describe this as password + Android Keystore-backed biometrics, rather than inventing a separate Aegis account system.

Backups: encrypted, user-controlled, and intentionally not “magic sync”

Aegis is designed around the idea that exporting your OTP database should be possible and safe. It supports exporting the vault, including encrypted backups (and it also allows unencrypted export—explicitly treated as risky in academic analysis of 2FA apps and in Aegis’ own UI warnings).

The important performance point here isn’t “speed” in the usual sense—OTP generation is trivial for any modern phone—but operational reliability: you can create an encrypted backup and restore it to a new device if you keep the password. There’s no dependency on a vendor cloud being up, a subscription staying active, or a provider deciding to deprecate a sync feature.

Switching costs: import support from other authenticators

Aegis puts real effort into migration. The Google Play listing states it can import entries from many other authenticators (including Google Authenticator, Authy, Microsoft Authenticator, and others), with the caveat that root access is required for importing from apps that don’t offer an export function. That’s a very practical warning—some apps lock your secrets down so hard that extraction becomes a device-level issue, not an Aegis feature issue.

Platform support (a real limitation)

Aegis is Android-only. If your workflow requires iOS, desktop, or first-party cross-platform sync, Aegis is not trying to be that product. It’s a local Android authenticator with export/import rather than a multi-device ecosystem.

Pricing and Plans

Free. Your database spec confirms the pricing model as free, and the public distribution channels back that up: the app is listed on F-Droid as free and open source, and the project is published openly on GitHub.

There’s no evidence (from the official listings and repository materials reviewed) of paid tiers, subscriptions, or in-app purchases being required for core functionality. Because it’s free, there’s also no meaningful “refund policy” to evaluate.

Privacy and Security Assessment

Data flow and “who sees your secrets”

Aegis is built around local storage: your OTP seeds live in the app’s vault on your device, and data only leaves the device if you export or back it up (for example, by saving an export file to a location you choose). Reviews focused on privacy repeatedly frame Aegis as “no cloud connection” / “no account” by default—meaning there’s no Aegis-hosted sync layer that requires trusting a vendor with your OTP database.

That’s good for privacy. It also increases the risk that careless users will skip backups and lose access during phone loss/reset—Aegis makes backup possible, but it won’t rescue you with an account recovery flow.

Encryption design (what we can actually substantiate)

Aegis’ GitHub README describes vault encryption using AES-256-GCM. Additional documentation describing the vault format explains how the master key and encryption parameters are used to encrypt/decrypt vault contents, and how different unlock “slots” protect the master key.

Independent academic work analyzing popular 2FA apps also includes Aegis in its dataset and discusses the broader architecture pattern (encrypting backups, warning on plaintext export, etc.). This doesn’t replace a full formal audit, but it’s stronger than “trust me, bro” security claims.

Open source posture (and what that does and doesn’t mean)

Aegis is open source and published on GitHub, and F-Droid lists it as GPL-licensed software (GPL v3). That enables public inspection and community scrutiny, but it is not the same thing as a professional third-party security audit. In other words: open source reduces blind trust; it doesn’t automatically guarantee “secure.”

Known incidents / audit status

From the sources reviewed here, there’s no clearly documented independent security audit that we can cite as definitive, and no well-sourced major breach incident tied to Aegis itself. So we’re not going to pretend one exists. If you need an app whose security claims are backed by a paid audit report, you should treat Aegis as “transparent and widely examined by the community,” not “audited.” (If you want, we can run a second pass specifically hunting for audit reports.)

Strengths and Limitations

Strengths

• Strong local security model: encrypted vault with modern authenticated encryption (AES-256-GCM) is clearly described in project materials.
• No forced cloud account: the core workflow doesn’t require Aegis-operated servers for syncing your OTP secrets.
• Migration-friendly: explicit import support from many authenticators is documented on the Play listing, with honest caveats about root requirements for locked-down apps.
• F-Droid availability and open-source licensing: easy to verify provenance and track releases across ecosystems.

Limitations

• Android-only: no official iOS app or desktop companion in the official distribution sources reviewed.
• No first-party cloud sync: you’re responsible for exports/backups and safe storage of the encryption password.
• Plaintext export is possible: Aegis warns about it, but the option exists—meaning user error can create a catastrophic leak.

Who Should Use Aegis Authenticator?

Good fit

1. Privacy-focused Android users who want OTP codes without a vendor account and without trusting a cloud sync provider with their OTP database.
2. People leaving Google/Authy/Microsoft authenticators who need real migration tooling and are willing to deal with export/import realities (including root caveats in some cases).
3. Security-conscious users who will actually manage backups (encrypted exports stored somewhere safe, and tested restores). Aegis supports encrypted backup/export flows explicitly.

Not a good fit

1. iPhone-only households or mixed-platform users who require a first-party iOS client.
2. Users who demand effortless multi-device sync with automatic recovery if they lose a phone. Aegis intentionally does not center a vendor cloud.
3. Anyone likely to skip backup hygiene—because “local-first” becomes “local-only” the moment your phone dies.