Authy vs 2FAS
2FAS wins · 7–17 (24 drawn)
Agenticness — how well agents can access and operate the productAgenticness
How well agents can access and operate the product
Agent access
ai-native userPoint an agent at llms.txt or agent-oriented docs
weight 2 · round to 2FASAuthynone0/10The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)
Direct probe confirms a live llms.txt with an explicit 'For AI agents' section, plus modular per-section llms files, llms-full.txt, per-page .md mirrors, and Accept: text/markdown rendering — strong first-party agent-oriented docs infrastructure verified via runtime probes. Missing for 10: no independent/community corroboration of agents actually consuming these docs in practice.
- [probe] “PROBE llms.txt: HTTP 200 at https://2fas.com/llms.txt # 2FAS — Password Manager and Authenticator > Local-first password manager (2FAS Pass…”
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
- [probe] “PROBE runtime (recorded 2026-09-15): machine-readable pricing verified live at https://2fas.com/.well-known/pricing.md — '# 2FAS Pricing... …”
ai-native userRun the product headlessly / in CI for automation
weight 2 · round drawnAuthynone0/10The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)
2FASnone0/102FAS is a mobile authenticator/password manager with no CLI, headless mode, or API for CI/automation; the product's own llms.txt explicitly declares 'Public API: None' and is local-first by design, meaning it cannot be run headlessly or scripted in CI.
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
- [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”
ai-native userConnect an agent via an official MCP server
weight 3 · round drawnAuthynone0/10The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)
2FASnone0/102FAS is a password/2FA manager, not an agent, so an MCP server axis could plausibly apply to its ecosystem; however evidence explicitly states 'Public API: None' and no OpenAPI/MCP endpoint exists, with probes confirming no API surface for agents to connect to.
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
- [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”
ai-native userUse an official CLI
weight 2 · round drawnAuthynone0/10The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)
2FASnone0/102FAS is a mobile/browser 2FA and password-manager app with no evidence of an official CLI; docs explicitly note 'Public API: None' and no CLI tool is mentioned anywhere in the evidence pack.
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
ai-native userDrive the product through a documented public API
weight 3 · round to AuthyAuthydisputedcontradicted2/10Twilio's own docs describe an SDK/API for integrating Authy (authy-docs-1, authy-docs-13), but a direct probe of the same page shows the Authy API is deprecated and 'closed to new customers' with 'no programmatic surface remains open to new integrations' (authy-probe-rt-1), meaning an AI-native user cannot actually drive Authy via a documented public API today. Missing for 10: an open, actively maintained public API for new integrations, migration path documentation usable by AI agents, and independent confirmation of working programmatic access.
- [claimed-docs] “we provide an SDK for common web languages. If your language is supported, it's the fastest way to get started.”
- [claimed-docs] “So you don't have to use the Authy API directly to integrate two-factor authentication into your app, we provide an SDK for common web langu…”
- [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”
2FASnone0/102FAS explicitly states 'Public API: None' in its own llms.txt, and OpenAPI/swagger probes all return 404, confirming there is no documented public API to drive the product programmatically — it is local-first by design.
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
- [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”
ai-native userIssue scoped/least-privilege API credentials for an agent
weight 2 · round drawnAuthynone0/10The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)
2FASnone0/102FAS is a local-first authenticator/password manager with no public API; its own llms.txt explicitly states 'Public API: None' and no agent-callable endpoint for token generation, so there is no mechanism to issue scoped/least-privilege API credentials for an agent.
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
- [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”
ai-native userBuild against official SDKs
weight 2 · round to AuthyAuthydisputedcontradicted3/10Twilio's docs claim official SDKs for common web languages to integrate Authy 2FA (authy-docs-1, authy-docs-13), but the same docs page also states the Authy API is closed to new customers and being deprecated in favor of Verify v2, meaning no new AI-native integration can actually be built against it. Missing for 10: evidence of an actively maintained, open-to-new-customers SDK, and any agentic/AI-specific tooling or examples.
- [claimed-docs] “we provide an SDK for common web languages. If your language is supported, it's the fastest way to get started.”
- [claimed-docs] “So you don't have to use the Authy API directly to integrate two-factor authentication into your app, we provide an SDK for common web langu…”
- [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”
2FASnone0/102FAS explicitly declares 'Public API: None' and has no OpenAPI/SDK endpoints; probes confirm no SDK or API surface exists for developers to build against.
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
- [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”
ai-native userSubscribe to events via webhooks
weight 2 · round drawnAuthynone0/10No evidence of any webhook subscription capability in Authy's docs or community reports; the product's API is deprecated with no new programmatic integrations mentioned. This is a fair axis for an authentication/API platform, but no support is documented.
- [claimed-docs] “we provide an SDK for common web languages. If your language is supported, it's the fastest way to get started.”
- [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”
2FASnone0/102FAS is explicitly local-first with no public API ('Public API: None' per its own llms.txt), and no evidence anywhere mentions webhooks or event subscriptions; this is a password/2FA app, not an event-driven platform.
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
Agentic features
ai-native userSet up automations that run autonomously in the background
weight 2 · round drawnAuthynone0/10The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)
ai-native userOperate the product with natural-language commands
weight 2 · round drawnAuthynone0/10The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)
Api quality
ai-native userExplore an interactive API reference with runnable examples
weight 2 · round drawnAuthynone0/10No evidence of an interactive API reference with runnable examples for Authy; docs pack only describes SDKs and app features, and the Authy API itself is now closed/deprecated in favor of Verify, with no mention of interactive docs or runnable code samples.
- [claimed-docs] “we provide an SDK for common web languages. If your language is supported, it's the fastest way to get started.”
- [claimed-docs] “So you don't have to use the Authy API directly to integrate two-factor authentication into your app, we provide an SDK for common web langu…”
- [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”
2FASnone0/10No evidence of an interactive API reference or runnable examples; openapi probe returned 404s across all candidate paths and llms.txt explicitly states 'Public API: None' since 2FAS is local-first with no agent-callable endpoints.
- [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)
weight 2 · round drawnAuthynone0/10Evidence only mentions SDKs and API docs (Verify/Authy), with no mention of a downloadable OpenAPI/Swagger spec or other machine-readable API definition; the Authy API is also noted as deprecated with no new integrations possible.
- [claimed-docs] “we provide an SDK for common web languages. If your language is supported, it's the fastest way to get started.”
- [claimed-docs] “So you don't have to use the Authy API directly to integrate two-factor authentication into your app, we provide an SDK for common web langu…”
- [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”
2FASnone0/10Direct probes for OpenAPI/swagger specs all returned 404, and the product's own llms.txt explicitly states 'Public API: None,' confirming no machine-readable API spec is offered.
- [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
ai-native userRely on versioned APIs with a documented deprecation policy
weight 2 · round to AuthyTwilio's docs do carry an explicit deprecation notice for the Authy API, stating it is closed to new customers and pointing to a migration guide toward Verify v2, which is a documented deprecation policy of sorts. However there is no evidence of a broader versioning scheme (e.g., v1/v2 semantics, changelogs, sunset timelines) beyond this one-time 'this API is dying' notice, and it applies to abandonment rather than an ongoing API lifecycle policy. missing for 10: evidence of a formal API versioning scheme, sunset/timeline commitments, changelog practices, and confirmation that Verify (the successor) itself has a documented deprecation policy.
- [claimed-docs] “For more information about migration, see Migrating from Authy to Verify for SMS”
- [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”
2FASnone0/102FAS explicitly declares 'Public API: None' and has no OpenAPI/swagger endpoints (all probes 404), meaning there is no versioned API at all, let alone a documented deprecation policy.
- [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
Automation depth — how much of the product can run unattendedAutomation depth
How much of the product can run unattended
ai-native userPerform bulk operations across many items at once
weight 2 · round drawnAuthynone0/10The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)
2FASnone0/102FAS is a local-first authenticator/password manager with no public API (explicitly declared 'Public API: None'), and no evidence of bulk operations across items (e.g., batch import/export beyond single-file import, bulk edit/delete of tokens or vault entries) that an AI agent could invoke. There's no scripting, CLI, or API surface for programmatic bulk actions.
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
- [claimed-docs] “We support imports from Aegis, Raivo, LastPassAegis, Stratum (formerly Authenticator Pro) and Google Authenticator.”
Openness — open source, data portability, and self-hosting storiesOpenness
Open source, data portability, and self-hosting stories
ai-native userDo everything through the API that I can do in the UI
weight 2 · round drawnAuthynone0/10Authy's API (the Twilio Authy API) is explicitly deprecated and closed to new customers per Twilio's own docs, and community reports confirm there is no way to export/manage 2FA data programmatically outside the mobile/desktop UI—users describe hacky workarounds just to extract seeds. There is no evidence of a supported API that mirrors the app's UI capabilities (device management, backup, sync, disabling installs, etc.).
- [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”
- [community] “Authy makes it hard to migrate away. Anyone know how to get the seed of the 2FA codes? Is there really no export option?”
- [community] “I just migrated off of Authy last week... Never liked it but they make it extremely difficult to export your data. Twilio really doesn't wan…”
- [community] “They intentionally make it really hard to migrate your data off their app under the premise of 'security'. Now they are EOL'ing desktop apps…”
- [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”
2FASnone0/102FAS's own llms.txt explicitly declares 'Public API: None' and probes confirm no OpenAPI/swagger spec exists at any candidate path, meaning there is no API surface at all through which a user could replicate UI actions.
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
- [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”
ai-native userExport all of my data in open formats and leave
weight 3 · round to 2FASAuthydisputedcontradicted2/10Authy provides no official open-format export tool; community reports (authy-comm-3, authy-comm-4, authy-comm-10, authy-comm-18) describe deliberately obstructed migration, requiring hacky Electron debug-mode QR dumps (authy-comm-14) rather than any documented export feature, directly contradicting any implicit claim of open portability. missing for 10: any first-party documentation of a data export feature or open format, evidence of a supported 'leave the platform' workflow, and confirmation that TOTP seeds/secrets can be retrieved without workarounds.
- [community] “Authy makes it hard to migrate away. Anyone know how to get the seed of the 2FA codes? Is there really no export option?”
- [community] “I just migrated off of Authy last week... Never liked it but they make it extremely difficult to export your data. Twilio really doesn't wan…”
- [community] “They intentionally make it really hard to migrate your data off their app under the premise of 'security'. Now they are EOL'ing desktop apps…”
- [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”
- [community] “I will also never forgive Authy for removing desktop support with near immediate deprecation and no way to export off their platform. I will…”
- [claimed-docs] “Use our backup feature incase you lose your phone. We encrypt your data, and only decrypt on the devices using a password only you know.”
2FAS explicitly supports exporting/backing up data (encrypted export files, self-host freedom, import/export in free tier) and even imports from competitor formats, showing some portability. However, there's no evidence the export format itself is documented as an open/standard schema (e.g., JSON spec or standard otpauth migration format), and the backup is typically encrypted for 2FAS's own re-import rather than a documented open format for third-party tools. missing for 10: explicit open/standard export format spec, independent confirmation the exported file is usable outside 2FAS ecosystem, and details on the exact format encoding.
- [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
- [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
- [claimed-docs] “Freedom to self-host your data”
- [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
- [community] “Free tier of 2FAS Pass includes auto-fill, import/export, and standard password generator; paid tier adds multi-device sync, more than 200 v…”
- [claimed-docs] “We support imports from Aegis, Raivo, LastPassAegis, Stratum (formerly Authenticator Pro) and Google Authenticator.”
ai-native userRead the product's source under an open license
weight 2 · round to 2FASAuthynone0/10The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)
2FAS explicitly points to its GitHub repositories for both the auth app and browser extension, describing itself as open-source, and the probe confirms 'open-source two-factor authentication' positioning with 'Freedom to self-host your data.' missing for 10: explicit license name (e.g., MIT/GPL) is not stated in evidence, and no independent audit confirming license terms.
- [claimed-docs] “You can easily take a look at our code - reflecting our transparent and user-first approach. Check out our GitHub repository”
- [claimed-docs] “Join our GitHub project and contribute to 2FAS by running code review and committing your ideas.”
- [claimed-docs] “Check out our GitHub repository and delve deep into the intricacies of the browser extension back-end.”
- [claimed-docs] “Freedom to self-host your data”
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
ai-native userSelf-host the core product
weight 3 · round to 2FASAuthynone0/10The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)
2FAS explicitly markets 'Freedom to self-host your data' and lets users choose their own cloud/WebDAV/external drive storage for vaults, and the core apps are open-source on GitHub for self-hosting/auditing. However, this is self-hosting of data/storage, not the full core service (no self-hostable server/backend, no API for self-managed infrastructure), and community commentary questions how this differs meaningfully from server-reliant competitors. Missing for 10: a self-hostable backend/server component, documentation of running the whole product on own infrastructure, and independent confirmation that self-hosted storage removes all vendor dependency.
- [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
- [claimed-docs] “Freedom to self-host your data”
- [claimed-docs] “You can easily take a look at our code - reflecting our transparent and user-first approach. Check out our GitHub repository”
- [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”
Passkey support — passkeys in the vault — storage, sign-in, cross-ecosystem syncPasskey support
Passkeys in the vault — storage, sign-in, cross-ecosystem sync
Storage
everyday userThe app stores passkeys and signs me into websites and apps with them, not just TOTP codes
weight 3 · round drawnAuthynone0/10Evidence only shows Twilio's separate Verify API service listing 'Passkeys' as one of many verification factors developers can integrate (authy-docs-2), not that the Authy consumer app itself stores user passkeys or lets users sign into websites/apps with them. All Authy app feature docs (docs-3 through docs-12) describe only TOTP/2FA sync, backups, and device management — no passkey storage or autofill capability is mentioned, and community evidence never discusses passkey sign-in via Authy.
- [claimed-docs] “Quickly verify users via SMS, Passkeys, Silent Network Auth, Voice, WhatsApp, TOTP, Push, Silent Device Approval, and Email.”
- [claimed-docs] “Sync 2FA across mobile and tablet.”
- [claimed-docs] “Use TouchID, PIN protection and passwords to protect access to your 2FA tokens.”
- [claimed-docs] “Easily capture 2FA QR codes from Facebook, Amazon, Google, Microsoft, Dropbox and many more.”
Sync
power userMy passkeys sync across ecosystems — iOS, Android, Windows, Linux, browsers — instead of being locked to one platform vendor
weight 2 · round drawnAuthynone0/10Authy's own docs describe syncing TOTP/2FA tokens across mobile/tablet devices (authy-docs-3, authy-docs-4), not passkeys; the only 'Passkeys' mention is in Twilio Verify API docs, which is a separate developer verification service, not evidence Authy itself stores or syncs WebAuthn passkeys across iOS/Android/Windows/Linux/browsers. No evidence shows Authy functioning as a cross-platform passkey manager.
- [claimed-docs] “Quickly verify users via SMS, Passkeys, Silent Network Auth, Voice, WhatsApp, TOTP, Push, Silent Device Approval, and Email.”
- [claimed-docs] “Sync 2FA across mobile and tablet.”
- [claimed-docs] “On any device. Your phone, tablet, even your Apple Watch.”
- [claimed-docs] “It's available for iOS, Android, macOS, Windows, and Linux.”
2FASnone0/10The evidence pack describes 2FAS Auth's 2FA token sync and 2FAS Pass's password vault sync (iCloud, Google Drive, WebDAV, browser extension) but contains no mention of 'passkey' or WebAuthn/FIDO2 credential support or storage anywhere. Since passkey sync is a distinct capability from OTP tokens or password items, there's no evidence this product delivers it.
Portability — your secrets stay yours — open export, bulk import, device migrationPortability
Your secrets stay yours — open export, bulk import, device migration
Export
power userExport all my TOTP secrets in an open, readable format and leave for another app whenever I choose — no lock-in
weight 3 · round to 2FASAuthydisputedcontradicted2/10Authy provides no official export feature for TOTP secrets, and community reports (authy-comm-3, authy-comm-4, authy-comm-10, authy-comm-18) confirm the app deliberately blocks migration/export, with users resorting to hacky workarounds like extracting keys via a deprecated Chrome extension debug mode (authy-comm-13, authy-comm-14). Docs never claim an export feature exists — only backup/sync within Authy's own ecosystem (authy-docs-5, authy-docs-3). missing for 10: any documented open/standard export format, first-party export tool, official migration path preserving secrets, and evidence contradicting the well-documented lock-in behavior.
- [claimed-docs] “Use our backup feature incase you lose your phone. We encrypt your data, and only decrypt on the devices using a password only you know.”
- [community] “Authy makes it hard to migrate away. Anyone know how to get the seed of the 2FA codes? Is there really no export option?”
- [community] “I just migrated off of Authy last week... Never liked it but they make it extremely difficult to export your data. Twilio really doesn't wan…”
- [community] “They intentionally make it really hard to migrate your data off their app under the premise of 'security'. Now they are EOL'ing desktop apps…”
- [community] “After a lot of trouble, I was able to extract my private keys from Authy by installing their deprecated Chrome extension and using some hack…”
- [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”
- [community] “I will also never forgive Authy for removing desktop support with near immediate deprecation and no way to export off their platform. I will…”
2FAS explicitly supports imports from other apps (Aegis, Raivo, Google Authenticator, etc.) and offers 2FAS export files for backup/sync, with optional password-based encryption of backups. However, evidence doesn't confirm the export format is an open/readable standard (e.g., plaintext otpauth URIs or documented JSON schema) rather than a proprietary encrypted blob, and there's no explicit statement about exporting TO other apps' formats for migration away from 2FAS. missing for 10: documented open/standard export format spec, explicit 'export to other apps' migration path, independent confirmation the export file is human-readable/portable.
- [claimed-docs] “We support imports from Aegis, Raivo, LastPassAegis, Stratum (formerly Authenticator Pro) and Google Authenticator.”
- [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
- [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
Import
power userImport tokens in bulk from other authenticator apps instead of re-enrolling every account by hand
weight 2 · round to 2FASAuthynone0/10Evidence shows Authy lets users add individual accounts via QR code capture (authy-docs-12) but nothing indicates a bulk import feature that pulls multiple existing tokens/accounts from other authenticator apps at once. Community evidence instead focuses on Authy making it hard to export data out, which is the opposite direction from what the story asks about.
- [claimed-docs] “Easily capture 2FA QR codes from Facebook, Amazon, Google, Microsoft, Dropbox and many more.”
- [community] “Authy makes it hard to migrate away. Anyone know how to get the seed of the 2FA codes? Is there really no export option?”
- [community] “I just migrated off of Authy last week... Never liked it but they make it extremely difficult to export your data. Twilio really doesn't wan…”
- [community] “They intentionally make it really hard to migrate your data off their app under the premise of 'security'. Now they are EOL'ing desktop apps…”
2FAS docs explicitly list bulk import support from Aegis, Raivo, LastPassAegis, Stratum, and Google Authenticator, directly supporting the power-user portability story. However, the list is limited to a handful of named apps, no evidence of a generic/universal import format (e.g., OTP URI batch, QR export from arbitrary apps), and no independent hands-on verification of the import process working smoothly. Missing for 10: broader import coverage beyond five named apps, independent/community confirmation of successful bulk import, and details on edge cases (e.g., failed imports, partial data loss).
- [claimed-docs] “We support imports from Aegis, Raivo, LastPassAegis, Stratum (formerly Authenticator Pro) and Google Authenticator.”
Migration
everyday userMoving to a new phone transfers all my tokens in one guided step
weight 2 · round drawnAuthy's own docs describe encrypted cloud backup, multi-device sync, and 'add new device with SMS/voice/existing device approval' as the guided path to move 2FA tokens to a new phone, which directly matches this story (authy-docs-3,4,5,10). Community comments about difficulty exporting data are about moving to a *different app*, not the in-ecosystem new-phone transfer, so they don't contradict this specific flow. Missing for 10: independent/hands-on confirmation that the new-phone restore process itself is smooth and single-step (most community friction reports concern cross-app export, not device-to-device transfer).
- [claimed-docs] “Sync 2FA across mobile and tablet.”
- [claimed-docs] “On any device. Your phone, tablet, even your Apple Watch.”
- [claimed-docs] “Use our backup feature incase you lose your phone. We encrypt your data, and only decrypt on the devices using a password only you know.”
- [claimed-docs] “Add new devices with SMS, voice or existing device approval.”
- [community] “I started using Authy long ago because it supports multiple devices and isn't linked to any other account (Google/Microsoft).”
2FAS Auth supports iCloud/Google Drive sync and encrypted export/backup files, letting a user restore tokens on a new device by simply enabling sync or importing the backup file, and 2FAS Pass has a dedicated recovery flow for restoring the vault on a different device via iCloud/Google Drive backups. missing for 10: a documented single-tap 'migrate to new phone' wizard UI and independent hands-on confirmation of the transfer experience.
- [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
- [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
- [claimed-docs] “Multi-device sync (encrypted)”
- [claimed-docs] “Learn how to restore access to your 2FAS Pass Vault or run it on a different device.”
- [claimed-docs] “If you have enabled sync with iCloud (on iOS) or Google Drive (on Android), your encrypted 2FAS Pass Vault file is right there.”
Privacy posture — data-handling and privacy storiesPrivacy posture
Data-handling and privacy stories
ai-native userChoose where my data is stored (region/residency)
weight 2 · round to 2FASAuthynone0/10The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)
2FAS is local-first: users choose to keep data on-device, in their own iCloud/Google Drive, WebDAV, or fully self-hosted, giving strong control over storage location (2fas-docs-5, 2fas-docs-14, 2fas-docs-17). This satisfies the spirit of data residency choice, though it's not a formal 'select region/datacenter' feature and relies on user-configured third-party clouds rather than a first-party regional hosting option. Missing for 10: explicit region/datacenter selection controls, independent verification of self-host setup beyond marketing pages.
- [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
- [claimed-docs] “Freedom to self-host your data”
- [claimed-docs] “Multi-device sync (encrypted)”
- [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
- [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”
ai-native userPrevent my data from being used to train AI models
weight 3 · round to 2FASAuthynone0/10The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)
2FAS is local-first with explicit 'no telemetry' claims and no public API for data collection (2fas-probe-rt-1, 2fas-probe-rt-2), which implies user data isn't centrally harvested and thus couldn't feed AI training pipelines. However, there is no explicit statement addressing AI model training or an opt-out policy specifically. Missing for 10: explicit AI-training data policy/opt-out statement, independent confirmation that no data is ever sent to third-party AI services.
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
- [probe] “PROBE runtime (recorded 2026-09-15): machine-readable pricing verified live at https://2fas.com/.well-known/pricing.md — '# 2FAS Pricing... …”
ai-native userControl data retention and deletion
weight 2 · round to 2FASAuthynone0/10No documentation shows Authy giving users control over data retention/export/deletion; instead multiple independent reports describe Twilio deliberately blocking data export ('no export option', 'extremely difficult to export your data') and forcing convoluted workarounds to extract keys, the opposite of user-controlled retention/deletion.
- [community] “Authy makes it hard to migrate away. Anyone know how to get the seed of the 2FA codes? Is there really no export option?”
- [community] “I just migrated off of Authy last week... Never liked it but they make it extremely difficult to export your data. Twilio really doesn't wan…”
- [community] “They intentionally make it really hard to migrate your data off their app under the premise of 'security'. Now they are EOL'ing desktop apps…”
- [community] “After a lot of trouble, I was able to extract my private keys from Authy by installing their deprecated Chrome extension and using some hack…”
- [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”
- [community] “I will also never forgive Authy for removing desktop support with near immediate deprecation and no way to export off their platform. I will…”
2FAS gives users explicit control over where data is stored (own cloud, external drive, self-hosting) and confirms no telemetry/tracking, which supports retention control (2fas-docs-5, 2fas-docs-14, 2fas-probe-rt-2). However there is no explicit documentation of a deletion/erasure workflow, data-retention policy, or account-deletion mechanism beyond implied local file control. Missing for 10: explicit data deletion/right-to-erasure documentation, retention period policy, and independent confirmation that deleting local/cloud copies fully removes data.
- [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
- [claimed-docs] “Freedom to self-host your data”
- [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
- [probe] “PROBE runtime (recorded 2026-09-15): machine-readable pricing verified live at https://2fas.com/.well-known/pricing.md — '# 2FAS Pricing... …”
ai-native userOpt out of telemetry and usage tracking
weight 2 · round to 2FASAuthynone0/10The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)
2FAS explicitly states in its machine-readable pricing/docs that 2FAS Auth has 'no advertising, no telemetry,' meaning tracking is absent by design rather than requiring opt-out, and the product is positioned as local-first/open-source, reinforcing a privacy-first posture. Missing for 10: no explicit dedicated privacy-settings toggle documentation, and no independent audit confirming zero telemetry across 2FAS Pass as well as Auth.
- [probe] “PROBE runtime (recorded 2026-09-15): machine-readable pricing verified live at https://2fas.com/.well-known/pricing.md — '# 2FAS Pricing... …”
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
Security posture — how it protects itself — app lock, E2EE design, audits, breach alertingSecurity posture
How it protects itself — app lock, E2EE design, audits, breach alerting
App lock
everyday userThe app itself locks behind biometrics or a PIN, so a borrowed phone doesn't expose my codes
weight 2 · round to AuthyTwilio's official docs claim TouchID, PIN, and password protection guarding access to 2FA tokens, and a community user independently corroborates using Face ID to lock the entire app on their phone. This directly matches the story of biometric/PIN app-lock preventing exposure on a borrowed phone. Missing for 10: more independent hands-on verification of PIN-specific lock behavior and no detail on lockout/failure edge cases.
- [claimed-docs] “Use TouchID, PIN protection and passwords to protect access to your 2FA tokens.”
- [community] “I use Authy with Face ID protecting the entire app on my phone... they'd still need the 2FA codes from my phone [even if password manager co…”
2FASnone0/10The evidence pack describes 2FAS Pass's tiered security and sync options, and confirms access to the browser extension/autofill must be approved in-app, but nowhere states that the 2FAS Auth or Pass app itself can be locked behind biometrics or a PIN to block access if the phone is borrowed. No docs or community evidence mention an app-lock/biometric-gate feature for the authenticator itself.
- [claimed-docs] “2FAS Pass supports 3 Security Tiers for protecting your Items.”
- [claimed-docs] “Access through the Browser Extension or using Autofill must be confirmed in 2FAS Pass.”
Audits
security engineerThe vendor publishes independent security audits of the app and its sync protocol
weight 2 · round drawnAuthynone0/10The evidence pack contains no vendor claim of independent third-party security audits of the app or its sync protocol; documentation focuses on feature descriptions (SDKs, sync, backup) with no audit reports or security whitepapers cited. Community evidence discusses a data breach and a slow-to-fix vulnerability, but these do not substitute for published audit evidence and there's no vendor claim to dispute.
2FASnone0/10Evidence shows only open-source code availability claims and general transparency messaging, with no mention of independent third-party security audits of the app or its sync protocol; community discussion even questions the trust model of cloud-based sync without referencing any audit report.
- [claimed-docs] “You can easily take a look at our code - reflecting our transparent and user-first approach. Check out our GitHub repository”
- [claimed-docs] “Join our GitHub project and contribute to 2FAS by running code review and committing your ideas.”
- [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”
Monitoring
power userThe app warns me when a service I use is breached or a stored credential is weak, reused, or exposed
weight 2 · round drawnAuthynone0/10No evidence Authy monitors for breached services, weak/reused/exposed credentials, or provides any security-posture alerts; evidence only covers 2FA sync, backup, device management, and separate breach news about Authy itself (not a feature it offers users).
2FASnone0/10No evidence of breach monitoring, weak/reused/exposed password detection, or security-posture alerts anywhere in the docs, community reports, or probes; 2FAS's evidence covers sync, tiers, self-hosting, and import/export but nothing about credential health warnings or breach alerts.
Push
it adminPush-based sign-in includes phishing defenses — number matching, location context, and admin-enforced MFA policies
weight 2 · round drawnAuthynone0/10Evidence only shows generic Push and Silent Device Approval support (authy-docs-2, authy-docs-15) with no mention of number matching, location context, or admin-enforced MFA policy controls; the Authy API itself is also noted as deprecated for new integrations (authy-probe-rt-1). Missing for 10: any documentation of number matching, location-based risk signals, or admin policy enforcement for push sign-in.
- [claimed-docs] “Quickly verify users via SMS, Passkeys, Silent Network Auth, Voice, WhatsApp, TOTP, Push, Silent Device Approval, and Email.”
- [claimed-docs] “Push and Silent Device Approval (iOS, Android, Web)”
- [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”
Self hosting — running it yourself — self-hosted servers, open-source clientsSelf hosting
Running it yourself — self-hosted servers, open-source clients
Server
it adminSelf-host the sync server on my own infrastructure and keep every secret inside my perimeter
weight 2 · round to 2FASAuthynone0/10The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)
2FAS advertises 'freedom to self-host your data' and lets users choose where encrypted vault/token data lives (own cloud, WebDAV, external drive) rather than relying on 2FAS-hosted storage, which partially satisfies the perimeter-control need. However there is no evidence of an actual downloadable/self-hostable 'sync server' component (e.g. a Vaultwarden-style server binary) — it's more bring-your-own-storage for encrypted files/backups, and community commentary explicitly questions whether this differs meaningfully from relying on third-party server infrastructure. Missing for 10: a dedicated self-hosted sync-server artifact/deployment docs, and independent confirmation that all sync traffic stays fully within admin-controlled infra.
- [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
- [claimed-docs] “Freedom to self-host your data”
- [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”
Source
security engineerThe client apps are open source, so the code handling my seeds can be inspected and community-reviewed
weight 2 · round to 2FASAuthynone0/10There is no evidence Authy's client apps are open source; evidence instead shows closed, proprietary apps with deliberately obstructed export/migration paths and hacky reverse-engineering required to extract seeds. This directly contradicts the premise of community-reviewable open-source code handling seeds.
- [community] “Authy makes it hard to migrate away. Anyone know how to get the seed of the 2FA codes? Is there really no export option?”
- [community] “I just migrated off of Authy last week... Never liked it but they make it extremely difficult to export your data. Twilio really doesn't wan…”
- [community] “They intentionally make it really hard to migrate your data off their app under the premise of 'security'. Now they are EOL'ing desktop apps…”
- [community] “After a lot of trouble, I was able to extract my private keys from Authy by installing their deprecated Chrome extension and using some hack…”
- [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”
2FAS explicitly markets itself as open-source and points to a public GitHub repo for code review, including for the browser extension backend ('delve deep into the intricacies'), and invites community contribution/code review. The core apps (2FAS Auth, described as 'Free, Open-source 2FA Authenticator App') are confirmed open-source via probe data. Missing for 10: no independent security audit report or third-party code-review corroboration is cited, and evidence doesn't explicitly confirm the mobile app repos (vs. just extension) are inspectable.
- [claimed-docs] “You can easily take a look at our code - reflecting our transparent and user-first approach. Check out our GitHub repository”
- [claimed-docs] “Join our GitHub project and contribute to 2FAS by running code review and committing your ideas.”
- [claimed-docs] “Check out our GitHub repository and delve deep into the intricacies of the browser extension back-end.”
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
Surfaces — where it meets your workflow — IDE, CLI, web, PR comments, CI checksSurfaces
Where it meets your workflow — IDE, CLI, web, PR comments, CI checks
Automation
ai-native userAn agent can fetch a current TOTP code programmatically — via CLI or API — to complete a 2FA login inside an automated workflow
weight 2 · round drawnAuthynone0/10Authy is a consumer authenticator app; there is no documented CLI/API for a user or agent to programmatically fetch their own current TOTP code, and Twilio's docs confirm the Authy API is deprecated and closed to new customers with no successor for this use case. Community evidence further shows Authy intentionally blocks exporting secrets/codes, requiring hacky workarounds (deprecated Chrome extension, debug-mode Electron hacks) rather than any supported programmatic access.
- [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”
- [community] “Authy makes it hard to migrate away. Anyone know how to get the seed of the 2FA codes? Is there really no export option?”
- [community] “I just migrated off of Authy last week... Never liked it but they make it extremely difficult to export your data. Twilio really doesn't wan…”
- [community] “After a lot of trouble, I was able to extract my private keys from Authy by installing their deprecated Chrome extension and using some hack…”
- [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”
2FASnone0/10The evidence explicitly states 2FAS has no public API for programmatic TOTP retrieval ('Public API: None — local-first by design, no agent-callable endpoint for token generation'), and no CLI is documented anywhere in the pack; OpenAPI probes all 404. This directly rules out agent-driven fetching of TOTP codes via CLI or API.
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
- [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”
ai-native userExpose the vault through a local programmatic endpoint an agent can query for codes and secrets without screen-scraping the app
weight 1 · round drawnAuthynone0/10No evidence Authy offers any local programmatic endpoint for agents to query codes/secrets; its API is closed to new customers and deprecated, and community reports describe the vault as deliberately hard to export via any means other than hacky manual extraction.
- [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”
- [community] “After a lot of trouble, I was able to extract my private keys from Authy by installing their deprecated Chrome extension and using some hack…”
- [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”
- [community] “I just migrated off of Authy last week... Never liked it but they make it extremely difficult to export your data. Twilio really doesn't wan…”
2FASnone0/10The product's own llms.txt explicitly states 'Public API: None' and no OpenAPI/local endpoint was found; 2FAS is local-first by design with no agent-callable interface for querying codes or secrets programmatically.
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
- [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”
Browser
everyday userA browser extension autofills my TOTP codes and passkeys during login instead of making me retype them
weight 2 · round to 2FASAuthynone0/10Evidence pack shows no current Authy browser extension for autofilling TOTP or passkeys; the only extension mentioned is a deprecated Chrome extension used via hacky workarounds to extract keys, not autofill. Authy's own product is a mobile/desktop authenticator app, and passkey support referenced is for Twilio Verify (a separate API product), not the Authy app/extension.
- [community] “After a lot of trouble, I was able to extract my private keys from Authy by installing their deprecated Chrome extension and using some hack…”
- [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”
- [claimed-docs] “Quickly verify users via SMS, Passkeys, Silent Network Auth, Voice, WhatsApp, TOTP, Push, Silent Device Approval, and Email.”
2FAS's browser extension is documented to autofill TOTP tokens with confirmation via the mobile app ('You don't have to retype anything'), and the 2FAS Pass extension supports autofill for passwords/passkeys confirmed in the vault app, with the free tier confirmed by community reports to include auto-fill. However, evidence is vendor-documented with only partial independent corroboration and no explicit hands-on confirmation of passkey autofill specifically working smoothly in-browser. Missing for 10: independent hands-on validation of passkey autofill UX, more detail on cross-browser support, and confirmation of friction-free flow beyond vendor claims.
- [claimed-docs] “Click the browser extension icon when you need to enter a 2FA token, then confirm in the mobile app. You don't have to retype anything.”
- [claimed-docs] “Access through the Browser Extension or using Autofill must be confirmed in 2FAS Pass.”
- [community] “Free tier of 2FAS Pass includes auto-fill, import/export, and standard password generator; paid tier adds multi-device sync, more than 200 v…”
- [claimed-docs] “You can easily take a look at our code - reflecting our transparent and user-first approach. Check out our GitHub repository”
Desktop
power userA first-class desktop app gives me codes and vault access on my computer, not just on mobile
weight 2 · round to AuthyAuthydisputedcontradicted4/10Twilio's docs list Authy as available on macOS, Windows, and Linux, suggesting first-class desktop apps, but hands-on community reports concretely contradict this, stating Authy is 'EOL'ing desktop apps' with 'near immediate deprecation' and no export path, leaving the desktop surface unreliable for power users. Missing for 10: no evidence of continued desktop app support with vault/code access, no independent confirmation the desktop client remains functional or maintained post-EOL announcement.
- [claimed-docs] “It's available for iOS, Android, macOS, Windows, and Linux.”
- [community] “They intentionally make it really hard to migrate your data off their app under the premise of 'security'. Now they are EOL'ing desktop apps…”
- [community] “I will also never forgive Authy for removing desktop support with near immediate deprecation and no way to export off their platform. I will…”
2FASnone0/10Evidence only shows mobile apps (iOS/Android) plus a browser extension, and the extension explicitly requires confirmation via the mobile app (2fas-docs-3, 2fas-docs-19) rather than functioning as an independent desktop client. No native desktop app for code generation or vault access is documented anywhere in the pack.
- [claimed-docs] “Click the browser extension icon when you need to enter a 2FA token, then confirm in the mobile app. You don't have to retype anything.”
- [claimed-docs] “Access through the Browser Extension or using Autofill must be confirmed in 2FAS Pass.”
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
Watch
everyday userRead my codes from my smartwatch without pulling out my phone
weight 1 · round drawnAuthy's own marketing page explicitly claims support on 'your phone, tablet, even your Apple Watch,' which directly matches the smartwatch-reading story, but this is a single first-party claim with no independent or hands-on confirmation of watch functionality (e.g., no community mention of using the watch app), and the API deprecation notice signals the product line is winding down. Missing for 10: independent/hands-on verification of the Apple Watch experience, detail on Wear OS or other smartwatch support, and confirmation the feature is still maintained post-deprecation.
- [claimed-docs] “On any device. Your phone, tablet, even your Apple Watch.”
- [claimed-docs] “Sync 2FA across mobile and tablet.”
- [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”
2FAS explicitly markets 'Apple Watch — Improved convenience and accessibility' as a feature, indicating watch support exists, but there's no detail on what functionality is available on the watch (e.g., whether codes are viewable standalone or require phone proximity) and no independent/hands-on confirmation of the experience. missing for 10: details on watch app functionality/UX, confirmation codes can be read without unlocking phone, independent hands-on review of the watch experience.
- [claimed-docs] “Apple Watch Improved convenience and accessibility.”
- [claimed-docs] “Apple WatchImproved convenience and accessibility.”
Sync backup — not losing your accounts — encrypted backup, multi-device sync, recoverySync backup
Not losing your accounts — encrypted backup, multi-device sync, recovery
Backup
security engineerBackups are end-to-end encrypted with a key the vendor never holds, and the encryption design is documented
weight 3 · round drawnAuthy's marketing page states backups are encrypted and 'only decrypt on the devices using a password only you know' (authy-docs-5), implying a vendor-can't-decrypt design, but there is no technical documentation of the encryption algorithm, key derivation, or threat model, and no independent audit confirming the vendor truly never holds the key. Community reports focus on account-takeover via device-add (authy-comm-15) and painful data export (authy-comm-13/14), not on breaking the underlying backup encryption, so this doesn't rise to a concrete dispute of the encryption claim itself. Missing for 10: a detailed whitepaper/spec of the E2E encryption scheme, key management details, and independent security audit or crypto review corroborating the zero-knowledge claim.
- [claimed-docs] “Use our backup feature incase you lose your phone. We encrypt your data, and only decrypt on the devices using a password only you know.”
- [community] “After a lot of trouble, I was able to extract my private keys from Authy by installing their deprecated Chrome extension and using some hack…”
- [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”
- [community] “The Twilio exploit allowed the hackers to add a new device to existing Authy accounts. This allowed them to sync the keys between devices wi…”
2FAS documents that backups/sync can be encrypted with a user password (docs-9, docs-17, docs-18) and that vault storage location is user-controlled, but the encryption is presented as optional ('we encourage you to do that') rather than guaranteed end-to-end by default, and there is no detailed technical whitepaper describing key derivation, zero-knowledge architecture, or threat model. Community discussion (2fas-comm-1) explicitly questions whether backups to iCloud/WebDAV truly avoid vendor/server trust, further undercutting a strong E2E claim. missing for 10: a dedicated cryptographic design document (algorithms, key derivation, zero-knowledge proof), confirmation that encryption is mandatory/default rather than opt-in, and independent security audit corroboration.
- [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
- [claimed-docs] “Multi-device sync (encrypted)”
- [claimed-docs] “If you have enabled sync with iCloud (on iOS) or Google Drive (on Android), your encrypted 2FAS Pass Vault file is right there.”
- [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
- [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”
Multi device
everyday userMy tokens are available on my phone, tablet, and computer at the same time, kept in sync automatically
weight 2 · round to 2FASAuthydisputedcontradicted4/10Docs and community confirm sync across phone/tablet (and even Apple Watch) works well and is a headline feature (authy-docs-3, authy-docs-4, authy-docs-16, authy-comm-1), but the 'computer' part of the story is directly contradicted: community reports Authy EOL'd its desktop apps, breaking the phone/tablet/computer parity the docs still describe (authy-comm-10, authy-comm-18). Missing for 10: confirmation that desktop/computer sync still functions today, and resolution of the desktop deprecation vs docs claim.
- [claimed-docs] “Sync 2FA across mobile and tablet.”
- [claimed-docs] “On any device. Your phone, tablet, even your Apple Watch.”
- [claimed-docs] “It's available for iOS, Android, macOS, Windows, and Linux.”
- [community] “I started using Authy long ago because it supports multiple devices and isn't linked to any other account (Google/Microsoft).”
- [community] “They intentionally make it really hard to migrate your data off their app under the premise of 'security'. Now they are EOL'ing desktop apps…”
- [community] “I will also never forgive Authy for removing desktop support with near immediate deprecation and no way to export off their platform. I will…”
2FAS documents syncing tokens across devices via iCloud/Google Drive and lists 'Multi-device sync (encrypted)' as a feature, and computer access is possible through a browser extension that confirms via the mobile app. However, this cross-device access relies on manual confirmation from the phone rather than tokens being independently and automatically available on a tablet/computer at all times, and multi-device sync appears gated behind a paid tier for the Pass product. Missing for 10: evidence of true simultaneous, always-available token access across phone/tablet/computer without per-use phone confirmation, and confirmation that Auth (not just Pass) multi-device sync is free and automatic.
- [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
- [claimed-docs] “Click the browser extension icon when you need to enter a 2FA token, then confirm in the mobile app. You don't have to retype anything.”
- [claimed-docs] “Multi-device sync (encrypted)”
- [community] “Free tier of 2FAS Pass includes auto-fill, import/export, and standard password generator; paid tier adds multi-device sync, more than 200 v…”
Recovery
everyday userLosing my phone doesn't lose my accounts — a documented recovery path restores my tokens on a new device
weight 3 · round to 2FASAuthy's official docs describe an encrypted backup feature that restores 2FA tokens to a new device using a user-known password, plus multi-device sync and device management (authy-docs-3,4,5,8,10), and a community user confirms this recovery path works in practice after phone loss/SIM replacement (authy-comm-19). Some community friction exists around exporting data to competing apps, but that's a separate migration-away concern, not evidence the phone-loss recovery path itself fails. Missing for 10: a detailed first-party step-by-step restore walkthrough, and broader independent corroboration beyond a single community anecdote.
- [claimed-docs] “Sync 2FA across mobile and tablet.”
- [claimed-docs] “On any device. Your phone, tablet, even your Apple Watch.”
- [claimed-docs] “Use our backup feature incase you lose your phone. We encrypt your data, and only decrypt on the devices using a password only you know.”
- [claimed-docs] “View information, rename, and remove lost/stolen devices.”
- [claimed-docs] “Add new devices with SMS, voice or existing device approval.”
- [community] “I've been using Authy as a backup for 1Password's 2FA since in a worst-case scenario I can get a replacement SIM card and get back into my 1…”
2FAS documents multi-device sync via iCloud/Google Drive/encrypted export files for the Auth app, plus a dedicated recovery page explaining how to restore or run the Pass Vault on a new device using the cloud-synced encrypted vault file, and supports importing from other authenticator apps for migration scenarios. This directly addresses losing a phone and restoring tokens elsewhere, though community commentary raises trust questions about relying on third-party cloud storage rather than disputing that recovery works. Missing for 10: independent hands-on verification of the actual recovery flow succeeding, and clearer detail on recovery when no cloud sync was enabled beforehand.
- [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
- [claimed-docs] “Learn how to restore access to your 2FAS Pass Vault or run it on a different device.”
- [claimed-docs] “If you have enabled sync with iCloud (on iOS) or Google Drive (on Android), your encrypted 2FAS Pass Vault file is right there.”
- [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
- [claimed-docs] “We support imports from Aegis, Raivo, LastPassAegis, Stratum (formerly Authenticator Pro) and Google Authenticator.”
- [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”
Team admin — shared and managed use — shared vaults, org policies, programmatic provisioningTeam admin
Shared and managed use — shared vaults, org policies, programmatic provisioning
Automation
ai-native userAn agent can create and update vault entries — seeding new TOTP secrets, storing credentials — through documented programmatic surfaces
weight 2 · round to AuthyAuthydisputedcontradicted2/10Docs mention an SDK for 'the Authy API' to integrate 2FA, but Twilio's own docs page (probe) states the Authy API is closed to new customers and being deprecated with no new integrations, and multiple community reports confirm there is no supported way to programmatically seed, export, or update vault entries — users describe extreme difficulty or hacky workarounds to even extract secrets. This directly contradicts any claim of a documented programmatic surface for agent-driven vault creation/updates. Missing for 10: any current API/SDK for creating or updating TOTP vault entries, official export/import endpoints, and first-party agent integration examples.
- [claimed-docs] “we provide an SDK for common web languages. If your language is supported, it's the fastest way to get started.”
- [claimed-docs] “So you don't have to use the Authy API directly to integrate two-factor authentication into your app, we provide an SDK for common web langu…”
- [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”
- [community] “Authy makes it hard to migrate away. Anyone know how to get the seed of the 2FA codes? Is there really no export option?”
- [community] “I just migrated off of Authy last week... Never liked it but they make it extremely difficult to export your data. Twilio really doesn't wan…”
- [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”
2FASnone0/10No programmatic API exists for creating/updating vault entries or seeding TOTP secrets; the product's own llms.txt explicitly states 'Public API: None' and openapi probes all 404, confirming no agent-callable surface for this workflow.
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
- [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”
Policy
it adminEnforce org-wide policies — require app lock, restrict export, mandate strong master credentials — across every member's app
weight 1 · round drawnAuthynone0/10Authy's evidence pack shows only consumer-facing features (per-device PIN/TouchID lock, backup password, device management) with no mention of any organization/admin console, centralized policy enforcement, or IT-admin controls across a team of users. The product is also being deprecated in favor of Verify, with no admin management surface described anywhere.
- [claimed-docs] “Use TouchID, PIN protection and passwords to protect access to your 2FA tokens.”
- [claimed-docs] “View information, rename, and remove lost/stolen devices.”
- [claimed-docs] “Disable future Authy app installations for improved security.”
- [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”
2FASnone0/102FAS is a consumer-focused authenticator/password manager with no evidence of centralized org policy management, admin dashboards, enforced app-lock policies, export restrictions, or credential strength mandates across users; it is explicitly local-first with no public API for such control (2fas-probe-rt-1). No IT-admin console or MDM/policy feature is documented anywhere in the pack.
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
- [claimed-docs] “Freedom to self-host your data”
- [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
Sharing
it adminMy team can share TOTP-protected logins through shared vaults or collections with per-member access control
weight 2 · round drawnAuthynone0/10Authy is a personal authenticator app with no evidence of shared vaults, collections, or per-member access control for team/admin management; evidence only covers individual multi-device sync and backup features. Community evidence even highlights difficulty exporting/sharing data at all, reinforcing the lack of team-sharing capability.
- [claimed-docs] “Sync 2FA across mobile and tablet.”
- [claimed-docs] “Use our backup feature incase you lose your phone. We encrypt your data, and only decrypt on the devices using a password only you know.”
- [community] “Authy makes it hard to migrate away. Anyone know how to get the seed of the 2FA codes? Is there really no export option?”
- [community] “I just migrated off of Authy last week... Never liked it but they make it extremely difficult to export your data. Twilio really doesn't wan…”
2FASnone0/102FAS is positioned as a personal, local-first authenticator/password manager with individual sync (iCloud/Google Drive/self-host) and multi-device sync for a single user, not team/organization features. No evidence of shared vaults, collections, or per-member access control for an IT-admin-managed team; the HN community discussion even questions its single-user 'local-only' security model, but nothing addresses team sharing at all.
- [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
- [claimed-docs] “Multi-device sync (encrypted)”
- [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”
- [community] “Free tier of 2FAS Pass includes auto-fill, import/export, and standard password generator; paid tier adds multi-device sync, more than 200 v…”
Totp core — the TOTP fundamentals — QR enrollment, organization, offline codes, non-standard tokensTotp core
The TOTP fundamentals — QR enrollment, organization, offline codes, non-standard tokens
Enrollment
everyday userScan a QR code and immediately start generating TOTP codes for a new account
weight 3 · round to AuthyAuthy's own product page states it can capture 2FA QR codes from major providers and lists TOTP as a supported authentication method, directly matching the scan-and-generate story, and community comments confirm ongoing everyday use of the app for this purpose. Missing for 10: a first-person hands-on account of the exact scan-to-code flow and more detailed onboarding documentation beyond the marketing feature list.
- [claimed-docs] “Easily capture 2FA QR codes from Facebook, Amazon, Google, Microsoft, Dropbox and many more.”
- [claimed-docs] “TOTP (Authenticator Apps)”
- [community] “I started using Authy long ago because it supports multiple devices and isn't linked to any other account (Google/Microsoft).”
- [community] “I've been using Authy as a backup for 1Password's 2FA since in a worst-case scenario I can get a replacement SIM card and get back into my 1…”
2FAS Auth is a well-known TOTP app and docs reference connecting accounts via video tutorials, but the evidence pack lacks any direct documentation or hands-on confirmation of the core QR-scan-to-code-generation flow. missing for 10: explicit documentation/screenshots of QR scanning UX, confirmation that codes generate immediately post-scan, independent/hands-on corroboration of the onboarding flow.
- [claimed-docs] “use our quick and easy-to-follow video tutorials to connect your online accounts.”
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
Offline
power userCodes generate fully offline — no network, no vendor account required just to see my TOTP codes
weight 2 · round to 2FASAuthydisputedcontradicted4/10Authy's own docs claim codes can be viewed without internet ('access secured websites without internet access on your phone'), but the product fundamentally requires creating a Twilio/Authy account tied to a phone number before any TOTP codes can be generated or viewed, and codes are further gated behind an app password — directly contradicting the 'no vendor account required' part of the story. Community evidence confirms this account-centric architecture (phone-number-as-username, multi-device sync tied to account, extraction of underlying seeds required hacky workarounds via a deprecated debug mode rather than a supported offline export).
- [claimed-docs] “You can still access secured websites without internet access on your phone.”
- [community] “I started using Authy long ago because it supports multiple devices and isn't linked to any other account (Google/Microsoft).”
- [community] “This doesn't scare me because in Authy you also set a password which without you cannot access the codes. The phone number here just acts as…”
- [community] “After a lot of trouble, I was able to extract my private keys from Authy by installing their deprecated Chrome extension and using some hack…”
- [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”
- [community] “services with Authy-integrated MFA (like Twitch) are 'managed' by Authy so it can regenerate the secret on the fly; your previously extracte…”
2FAS Auth is described as open-source, local-first with no public API for token generation, and pricing docs confirm it's free with no telemetry, consistent with fully offline TOTP generation without vendor account requirement. Community evidence questions cloud-sync/backup security but this concerns 2FAS Pass (password manager), not the core Auth TOTP generation flow. missing for 10: independent hands-on confirmation that TOTP codes generate with device fully offline (airplane mode test), and explicit documentation stating no account/signup is ever required.
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
- [probe] “PROBE runtime (recorded 2026-09-15): machine-readable pricing verified live at https://2fas.com/.well-known/pricing.md — '# 2FAS Pricing... …”
- [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
Organization
power userKeep dozens of tokens organized — search, folders or groups, and service icons — so the right code is always two taps away
weight 2 · round to 2FASAuthynone0/10Evidence shows only basic token/QR capture (service icons implied) with no mention of search or folder/group organization; a community user explicitly complains 'can't we please have alphabetization?' indicating the app lacks even simple sorting, let alone search/folders for power users managing dozens of tokens.
- [claimed-docs] “Easily capture 2FA QR codes from Facebook, Amazon, Google, Microsoft, Dropbox and many more.”
- [community] “My guess is that most of the people who worked on Authy have fallen by the wayside after the Twilio acquisition. It's annoying every time I …”
Docs confirm token customization with 'full control over groups, badges, icons, and labels' and Apple Watch access, directly supporting organization by groups/icons for quick access, but there is no mention of search functionality within the token list, no detail on folder/group UX depth, and no independent hands-on account of managing 'dozens of tokens' at scale. missing for 10: explicit search feature evidence, hands-on/independent validation of organization UX at scale, deeper detail on folder vs group implementation.
- [claimed-docs] “Token customization Full control over the groups, badges, icons, and labels.”
- [claimed-docs] “Token customizationFull control over the groups, badges, icons, and labels.”
- [claimed-docs] “Apple Watch Improved convenience and accessibility.”
- [claimed-docs] “Apple WatchImproved convenience and accessibility.”
Variants
power userNon-standard tokens work too — Steam Guard, HOTP counters, custom periods and digit lengths
weight 2 · round drawnAuthynone0/10No evidence anywhere in the pack mentions Steam Guard support, HOTP counter-based tokens, or custom period/digit configurations; documentation only references standard TOTP and QR-code capture from mainstream services. Absence of evidence for this applicable power-user axis yields 'none'.
2FASnone0/10No evidence in the pack addresses Steam Guard tokens, HOTP counter-based codes, or custom period/digit-length configuration for 2FAS Auth — the docs only mention generic 'token customization' for groups/badges/icons/labels, which is unrelated to non-standard token algorithms.
- [claimed-docs] “Token customization Full control over the groups, badges, icons, and labels.”
- [claimed-docs] “Token customizationFull control over the groups, badges, icons, and labels.”
Not comparable on these axes
ai-native userPlug MCP servers into this product so it can use their tools
weight 3 · not comparableAuthyn/aAuthy is a 2FA/authenticator app, not an agentic AI product or platform with a tool-use ecosystem; plugging MCP servers into it for tool use is a category error for this product type.
2FASn/a2FAS is a password manager/2FA authenticator app, not an AI agent or platform with MCP tool-plugin capability; the product's own docs explicitly state 'Public API: None' and it has no agent/tool-integration surface. Plugging MCP servers into it for tool use is a category error for this product type.
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
ai-native userGet AI-generated insights and suggestions from my data inside the product
weight 2 · not comparableAuthyn/aAuthy is a 2FA/authenticator product; AI-generated insights or suggestions from user data is a category mismatch, not something a 2FA app category would ship.
2FASn/a2FAS is a 2FA authenticator/password manager focused on secure credential storage and sync, not a data-analytics or AI-insights product; there is no dataset or usage history it analyzes to generate suggestions. The evidence explicitly confirms it has no public API and is local-first by design, reinforcing that AI-generated insights are outside its product category.
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
ai-native userDelegate tasks to a built-in AI assistant inside the product
weight 3 · not comparableAuthyn/aAuthy is a 2FA/authentication app; delegating tasks to a built-in AI assistant is a wrong-axis question for this product category, with no evidence it ships any AI assistant feature.
2FASn/a2FAS is a 2FA authenticator/password manager with no built-in AI assistant feature; delegating tasks to an AI assistant is not a fair axis for this product category. Evidence even confirms 'Public API: None' and no agent-callable endpoints, reinforcing this is out of scope rather than a missing feature.
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
ai-native userTest against a sandbox environment without touching production data
weight 1 · not comparableAuthyn/aAuthy is a consumer 2FA app/service, not an AI-native developer tool with sandbox/test environments for agentic testing; no evidence pack content addresses sandbox vs production environments for AI agent testing, making this axis a category error for this product.
2FASn/a2FAS is a consumer password/2FA manager with no API or developer sandbox concept; there's no test/production data separation to speak of since it's local-first with no public API ('Public API: None'). This story targets developer-platform/agentic products with sandbox environments, which is a category error for a personal auth app.
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
ai-native userDefine rules that trigger actions automatically on events
weight 3 · not comparableAuthyn/aAuthy is a 2FA authenticator app/service, not an automation or workflow-rules platform; defining event-triggered rules is outside its product category and there is no evidence of such a feature.
2FASn/a2FAS is a local-first authenticator/password manager with no public API or event-driven automation surface (llms.txt explicitly declares 'Public API: None'); rule-based automation triggers are outside the scope of what this product category offers.
- [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
ai-native userSchedule recurring jobs or workflows
weight 2 · not comparableAuthyn/aAuthy is a 2FA/authenticator app; scheduling recurring jobs or workflows is not a relevant capability for this product category.
ai-native userVersion, review, and roll back my automations
weight 1 · not comparableAuthyn/aAuthy is a 2FA/authentication app, not an automation-building tool; versioning, reviewing, and rolling back 'automations' is not a concept that applies to this product category.