Authenticator Apps — procurement report
ProductArena · rankings as of 2026-09-15 · evidence as of 2026-09-15 · 8 products · 55 judged requirements · 440 judged cells
Methodology: Every product is judged against a shared taxonomy of user stories using cited evidence — hands-on probes > repository code > independent community sources > vendor claims — never opinion. Full writeup: https://ultrametric.ai/productarena/methodology
Leaderboard
| # | Product | PA Score | Coverage score | Applicable cells | Confidence |
|---|---|---|---|---|---|
| 1 | Bitwarden | 37.3 | 36.5 | 52/55 | B |
| 2 | 1Password | 28.0 | 27.0 | 53/55 | C |
| 3 | Ente Auth | 17.8 | 29.2 | 47/55 | B |
| 4 | Proton Pass | 16.1 | 21.0 | 49/55 | C |
| 5 | 2FAS | 10.5 | 22.8 | 48/55 | A |
| 6 | Authy | 2.6 | 10.0 | 48/55 | C |
| 7 | Google Authenticator | 1.5 | 9.5 | 45/55 | D |
| 8 | Microsoft Authenticator | 1.1 | 5.3 | 46/55 | C |
PA Score = agent-readiness blend (see methodology). Coverage score = weighted share of judged requirements met. Confidence = how much of the score rests on tested vs claimed evidence (A–D).
Uncertainty note
The current #1/#2 gap in this arena is not close enough to qualify for the multi-judge uncertainty pass (or the pass has not covered it yet) — no extra caveat applies beyond the per-product confidence grades above.
Buyer checklist (RFP)
The arena's 55 judged user stories as requirements, grouped by theme. Priorities mirror the story weights our scoring uses (3 = must-have, 2 = should-have, 1 = nice-to-have). Interactive version with per-requirement verdicts for the top products: /arena/authenticator-apps/checklist
Agenticness — how well agents can access and operate the productAgenticness
How well agents can access and operate the product
- ai-native userPlug MCP servers into this product so it can use their toolsmust-have
- ai-native userConnect an agent via an official MCP servermust-have
- ai-native userDrive the product through a documented public APImust-have
- ai-native userDelegate tasks to a built-in AI assistant inside the productmust-have
- ai-native userPoint an agent at llms.txt or agent-oriented docsshould-have
- ai-native userRun the product headlessly / in CI for automationshould-have
- ai-native userUse an official CLIshould-have
- ai-native userIssue scoped/least-privilege API credentials for an agentshould-have
- ai-native userBuild against official SDKsshould-have
- ai-native userSubscribe to events via webhooksshould-have
- ai-native userGet AI-generated insights and suggestions from my data inside the productshould-have
- ai-native userSet up automations that run autonomously in the backgroundshould-have
- ai-native userOperate the product with natural-language commandsshould-have
- ai-native userExplore an interactive API reference with runnable examplesshould-have
- ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)should-have
- ai-native userRely on versioned APIs with a documented deprecation policyshould-have
- ai-native userTest against a sandbox environment without touching production datanice-to-have
Automation depth — how much of the product can run unattendedAutomation depth
How much of the product can run unattended
- ai-native userDefine rules that trigger actions automatically on eventsmust-have
- ai-native userPerform bulk operations across many items at onceshould-have
- ai-native userSchedule recurring jobs or workflowsshould-have
- ai-native userVersion, review, and roll back my automationsnice-to-have
Openness — open source, data portability, and self-hosting storiesOpenness
Open source, data portability, and self-hosting stories
- ai-native userExport all of my data in open formats and leavemust-have
- ai-native userSelf-host the core productmust-have
- ai-native userDo everything through the API that I can do in the UIshould-have
- ai-native userRead the product's source under an open licenseshould-have
Passkey support — passkeys in the vault — storage, sign-in, cross-ecosystem syncPasskey support
Passkeys in the vault — storage, sign-in, cross-ecosystem sync
- everyday userThe app stores passkeys and signs me into websites and apps with them, not just TOTP codesmust-have
- power userMy passkeys sync across ecosystems — iOS, Android, Windows, Linux, browsers — instead of being locked to one platform vendorshould-have
Portability — your secrets stay yours — open export, bulk import, device migrationPortability
Your secrets stay yours — open export, bulk import, device migration
- power userExport all my TOTP secrets in an open, readable format and leave for another app whenever I choose — no lock-inmust-have
- power userImport tokens in bulk from other authenticator apps instead of re-enrolling every account by handshould-have
- everyday userMoving to a new phone transfers all my tokens in one guided stepshould-have
Privacy posture — data-handling and privacy storiesPrivacy posture
Data-handling and privacy stories
- ai-native userPrevent my data from being used to train AI modelsmust-have
- ai-native userChoose where my data is stored (region/residency)should-have
- ai-native userControl data retention and deletionshould-have
- ai-native userOpt out of telemetry and usage trackingshould-have
Security posture — how it protects itself — app lock, E2EE design, audits, breach alertingSecurity posture
How it protects itself — app lock, E2EE design, audits, breach alerting
- everyday userThe app itself locks behind biometrics or a PIN, so a borrowed phone doesn't expose my codesshould-have
- security engineerThe vendor publishes independent security audits of the app and its sync protocolshould-have
- power userThe app warns me when a service I use is breached or a stored credential is weak, reused, or exposedshould-have
- it adminPush-based sign-in includes phishing defenses — number matching, location context, and admin-enforced MFA policiesshould-have
Self hosting — running it yourself — self-hosted servers, open-source clientsSelf hosting
Running it yourself — self-hosted servers, open-source clients
- it adminSelf-host the sync server on my own infrastructure and keep every secret inside my perimetershould-have
- security engineerThe client apps are open source, so the code handling my seeds can be inspected and community-reviewedshould-have
Surfaces — where it meets your workflow — IDE, CLI, web, PR comments, CI checksSurfaces
Where it meets your workflow — IDE, CLI, web, PR comments, CI checks
- ai-native userAn agent can fetch a current TOTP code programmatically — via CLI or API — to complete a 2FA login inside an automated workflowshould-have
- everyday userA browser extension autofills my TOTP codes and passkeys during login instead of making me retype themshould-have
- power userA first-class desktop app gives me codes and vault access on my computer, not just on mobileshould-have
- ai-native userExpose the vault through a local programmatic endpoint an agent can query for codes and secrets without screen-scraping the appnice-to-have
- everyday userRead my codes from my smartwatch without pulling out my phonenice-to-have
Sync backup — not losing your accounts — encrypted backup, multi-device sync, recoverySync backup
Not losing your accounts — encrypted backup, multi-device sync, recovery
- security engineerBackups are end-to-end encrypted with a key the vendor never holds, and the encryption design is documentedmust-have
- everyday userLosing my phone doesn't lose my accounts — a documented recovery path restores my tokens on a new devicemust-have
- everyday userMy tokens are available on my phone, tablet, and computer at the same time, kept in sync automaticallyshould-have
Team admin — shared and managed use — shared vaults, org policies, programmatic provisioningTeam admin
Shared and managed use — shared vaults, org policies, programmatic provisioning
- ai-native userAn agent can create and update vault entries — seeding new TOTP secrets, storing credentials — through documented programmatic surfacesshould-have
- it adminMy team can share TOTP-protected logins through shared vaults or collections with per-member access controlshould-have
- it adminEnforce org-wide policies — require app lock, restrict export, mandate strong master credentials — across every member's appnice-to-have
Totp core — the TOTP fundamentals — QR enrollment, organization, offline codes, non-standard tokensTotp core
The TOTP fundamentals — QR enrollment, organization, offline codes, non-standard tokens
- everyday userScan a QR code and immediately start generating TOTP codes for a new accountmust-have
- power userCodes generate fully offline — no network, no vendor account required just to see my TOTP codesshould-have
- power userKeep dozens of tokens organized — search, folders or groups, and service icons — so the right code is always two taps awayshould-have
- power userNon-standard tokens work too — Steam Guard, HOTP counters, custom periods and digit lengthsshould-have
Appendix: recorded probes
Hands-on probe recordings — transcripts/videos a human can replay, the strongest evidence tier. Watch them at https://ultrametric.ai/productarena/proofs
- 1Password
brew info --json=v2 1password-cli | grep descterminal · recorded 2026-09-15 · exit 0 - 1Password
curl -s -X POST https://www.1password.dev/mcp -H 'Content-Type: application/json' -d '<jsonrpc initialize>' # FULL keyless handshaketerminal · recorded 2026-09-15 · exit 0 - 1Password
curl -sL https://www.1password.dev/llms.txt | head -4terminal · recorded 2026-09-15 · exit 0 - 1Password
curl -sL https://www.1password.dev/cli/get-started.md | head -8terminal · recorded 2026-09-15 · exit 0 - 2FAS
curl -sL https://2fas.com/auth.md | head -2terminal · recorded 2026-09-15 · exit 0 - 2FAS
curl -s https://2fas.com/llms.txt | head -4terminal · recorded 2026-09-15 · exit 0 - 2FAS
curl -sL https://2fas.com/.well-known/pricing.md | head -2terminal · recorded 2026-09-15 · exit 0 - Authy
curl -sL https://www.twilio.com/docs/authy | grep -o 'The Authy API is now closed to new customers...'terminal · recorded 2026-09-15 · exit 0 - Bitwarden
npx -y @bitwarden/cli --versionterminal · recorded 2026-09-15 · exit 0 - Bitwarden
echo <jsonrpc initialize> | npx -y @bitwarden/mcp-serverterminal · recorded 2026-09-15 · exit 0 - Bitwarden
curl -sL https://bitwarden.com/help/cli.md | head -4terminal · recorded 2026-09-15 · exit 0 - Bitwarden
curl -s https://bitwarden.com/llms.txt | head -4terminal · recorded 2026-09-15 · exit 0 - Ente Auth
brew info --json=v2 ente-cli | grep descterminal · recorded 2026-09-15 · exit 0 - Ente Auth
curl -s https://ente.com/llms.txt | head -4terminal · recorded 2026-09-15 · exit 0
Cite as: ProductArena by Ultrametric Inc, Authenticator Apps arena, rankings as of 2026-09-15 — https://ultrametric.ai/productarena/arena/authenticator-apps
License: © 2026 Ultrametric Inc. Brief quotation of individual verdicts, scores, or evidence excerpts is permitted with attribution to "ProductArena by Ultrametric Inc (ultrametric.ai/productarena)", as is use of the data to evaluate, contest, or contribute corrections. Bulk copying, redistribution, or use to build competing datasets requires prior written permission (see DATA-LICENSE in the repository).
No liability: rankings, verdicts, and scores are research outputs derived from the cited evidence at a point in time, provided "as is", without warranties. Ultrametric Inc accepts no responsibility for procurement, purchasing, or other decisions made in reliance on them — verify against the cited evidence before acting (https://ultrametric.ai/productarena/terms).