Authy vs Ente Auth

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round to Ente Auth
   Authy—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Ente Auth✓fullprobed7/10

   Ente serves a live llms.txt at ente.com/llms.txt confirmed by two independent probes, giving an agent a fair entry point; however, docs-as-markdown and OpenAPI endpoints 404, so agent-oriented documentation beyond the single llms.txt file is thin. missing for 10: markdown-served docs pages, OpenAPI/agent-consumable API spec, broader agent-oriented doc structure beyond one root file.

   • [probe] “PROBE llms.txt: HTTP 200 at https://ente.com/llms.txt # Ente > Ente builds private, end-to-end encrypted apps for photos, two-factor authen…”
   • [probe] “PROBE runtime (recorded 2026-09-15): ente.com serves a live llms.txt — '# Ente — Ente builds private, end-to-end encrypted apps for photos, …”
   • [probe] “PROBE docs-md: HTTP 404 at https://ente.com/help/auth/.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://ente.com/openapi.json, https://ente.com/swagger.json, https://ente.com/api/openapi.json, htt…”

   proof ↗⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round to Ente Auth
   Authy—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Ente Auth~partialprobed3/10

   Ente provides an official CLI (ente-cli) that can run headlessly to export/backup Auth codes, which is scriptable and could be used in automation/CI contexts, but evidence only documents it for exporting/decrypting backups, not for generic headless operation, generating TOTP codes on demand, or CI-integrated workflows. Missing for 10: documentation of CLI usage for retrieving/generating codes programmatically, CI-specific examples, and any first-party statement about automation/agentic use beyond backup.

   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”

   proof ↗⚑ flag

3. ai-native userConnect an agent via an official MCP server

   weight 3 · round drawn
   Authy—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Ente Auth—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

4. ai-native userUse an official CLI

   weight 2 · round to Ente Auth
   Authy—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Ente Auth~partialprobed6/10

   Ente ships an official CLI (github.com/ente/ente/tree/main/cli) confirmed to be packaged via Homebrew as 'ente-cli', documented as scriptable tooling to 'automatically backup your Auth codes' and decrypt exports — this is a real, official, automatable interface. However it is scoped narrowly to backup/export/decrypt operations rather than full account/code management or general agentic control. Missing for 10: broader CLI command coverage (add/edit/delete codes, sharing, sync), first-party docs detailing CLI usage beyond export, and independent hands-on reports of using it in automated/agentic workflows.

   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”

   proof ↗⚑ flag

5. ai-native userDrive the product through a documented public API

   weight 3 · round to Ente Auth
   Authy!disputedcontradicted2/10

   Twilio's own docs describe an SDK/API for integrating Authy (authy-docs-1, authy-docs-13), but a direct probe of the same page shows the Authy API is deprecated and 'closed to new customers' with 'no programmatic surface remains open to new integrations' (authy-probe-rt-1), meaning an AI-native user cannot actually drive Authy via a documented public API today. Missing for 10: an open, actively maintained public API for new integrations, migration path documentation usable by AI agents, and independent confirmation of working programmatic access.

   • [claimed-docs] “we provide an SDK for common web languages. If your language is supported, it's the fastest way to get started.”
   • [claimed-docs] “So you don't have to use the Authy API directly to integrate two-factor authentication into your app, we provide an SDK for common web langu…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”

   proof ↗⚑ flag

   Ente Auth~partialprobed3/10

   Ente provides a CLI (ente-cli) for exporting/backing up Auth codes and a documented deep-link scheme (enteauth://search), but there is no documented public REST/GraphQL API or SDK for driving the product programmatically — OpenAPI probes returned 404s. missing for 10: a documented public API/SDK covering core operations (add/edit/delete codes, sharing, sync), API authentication docs, and independent developer corroboration of API usage.

   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”
   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [claimed-docs] “Added support for search deep links via enteauth://search.”
   • [probe] “PROBE openapi: all candidate paths 404 (https://ente.com/openapi.json, https://ente.com/swagger.json, https://ente.com/api/openapi.json, htt…”

   proof ↗⚑ flag

6. ai-native userIssue scoped/least-privilege API credentials for an agent

   weight 2 · round drawn
   Authy—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Ente Auth—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

7. ai-native userBuild against official SDKs

   weight 2 · round to Authy
   Authy!disputedcontradicted3/10

   Twilio's docs claim official SDKs for common web languages to integrate Authy 2FA (authy-docs-1, authy-docs-13), but the same docs page also states the Authy API is closed to new customers and being deprecated in favor of Verify v2, meaning no new AI-native integration can actually be built against it. Missing for 10: evidence of an actively maintained, open-to-new-customers SDK, and any agentic/AI-specific tooling or examples.

   • [claimed-docs] “we provide an SDK for common web languages. If your language is supported, it's the fastest way to get started.”
   • [claimed-docs] “So you don't have to use the Authy API directly to integrate two-factor authentication into your app, we provide an SDK for common web langu…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”

   proof ↗⚑ flag

   Ente Auth—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Agentic features

1. ai-native userSet up automations that run autonomously in the background

   weight 2 · round drawn
   Authy—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Ente Auth—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

2. ai-native userOperate the product with natural-language commands

   weight 2 · round drawn
   Authy—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Ente Auth—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Api quality

1. ai-native userExplore an interactive API reference with runnable examples

   weight 2 · round drawn
   Authy—none0/10

   No evidence of an interactive API reference with runnable examples for Authy; docs pack only describes SDKs and app features, and the Authy API itself is now closed/deprecated in favor of Verify, with no mention of interactive docs or runnable code samples.

   • [claimed-docs] “we provide an SDK for common web languages. If your language is supported, it's the fastest way to get started.”
   • [claimed-docs] “So you don't have to use the Authy API directly to integrate two-factor authentication into your app, we provide an SDK for common web langu…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”

   proof ↗⚑ flag

   Ente Auth—none0/10

   No evidence of an interactive API reference or runnable examples; OpenAPI/swagger probes returned 404s and no developer API docs are mentioned anywhere in the pack.

   • [probe] “PROBE openapi: all candidate paths 404 (https://ente.com/openapi.json, https://ente.com/swagger.json, https://ente.com/api/openapi.json, htt…”
   • [probe] “PROBE docs-md: HTTP 404 at https://ente.com/help/auth/.md”

   proof ↗⚑ flag

2. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round drawn
   Authy—none0/10

   Evidence only mentions SDKs and API docs (Verify/Authy), with no mention of a downloadable OpenAPI/Swagger spec or other machine-readable API definition; the Authy API is also noted as deprecated with no new integrations possible.

   • [claimed-docs] “we provide an SDK for common web languages. If your language is supported, it's the fastest way to get started.”
   • [claimed-docs] “So you don't have to use the Authy API directly to integrate two-factor authentication into your app, we provide an SDK for common web langu…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”

   proof ↗⚑ flag

   Ente Auth—none0/10

   Probe results explicitly show all candidate OpenAPI/Swagger paths return 404, and there is no documented machine-readable API spec anywhere in the evidence pack; missing for 10: any published OpenAPI/Swagger file, API reference docs, or equivalent machine-readable spec.

   • [probe] “PROBE openapi: all candidate paths 404 (https://ente.com/openapi.json, https://ente.com/swagger.json, https://ente.com/api/openapi.json, htt…”

   proof ↗⚑ flag

3. ai-native userRely on versioned APIs with a documented deprecation policy

   weight 2 · round to Authy
   Authy~partialprobed4/10

   Twilio's docs do carry an explicit deprecation notice for the Authy API, stating it is closed to new customers and pointing to a migration guide toward Verify v2, which is a documented deprecation policy of sorts. However there is no evidence of a broader versioning scheme (e.g., v1/v2 semantics, changelogs, sunset timelines) beyond this one-time 'this API is dying' notice, and it applies to abandonment rather than an ongoing API lifecycle policy. missing for 10: evidence of a formal API versioning scheme, sunset/timeline commitments, changelog practices, and confirmation that Verify (the successor) itself has a documented deprecation policy.

   • [claimed-docs] “For more information about migration, see Migrating from Authy to Verify for SMS”
   • [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”

   proof ↗⚑ flag

   Ente Auth—none0/10

   Ente Auth is a 2FA authenticator app; there is no evidence of a public API, API versioning scheme, or documented deprecation policy — OpenAPI probes 404 and no API docs exist in the evidence pack.

   • [probe] “PROBE openapi: all candidate paths 404 (https://ente.com/openapi.json, https://ente.com/swagger.json, https://ente.com/api/openapi.json, htt…”
   • [probe] “PROBE docs-md: HTTP 404 at https://ente.com/help/auth/.md”

   proof ↗⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round to Ente Auth
   Authy—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Ente Auth~partialprobed4/10

   Ente Auth documents bulk import from other 2FA apps and a CLI tool for scripted export/backup of all codes, which supports some automation-depth for a bulk operation, but there is no evidence of programmatic bulk editing, deleting, or tagging across many stored codes at once (only single-item edit/delete via long-press is documented). missing for 10: bulk edit/delete/tag API or CLI beyond import/export, evidence of scripted multi-item management, independent hands-on confirmation of bulk workflows.

   • [claimed-docs] “Bulk import from other 2FA apps”
   • [claimed-docs] “Ente Auth natively supports imports from many 2FA providers.”
   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”
   • [claimed-docs] “You can delete or edit a code by long pressing (or right clicking on desktop) on that item.”

   proof ↗⚑ flag

1. ai-native userDo everything through the API that I can do in the UI

   weight 2 · round drawn
   Authy—none0/10

   Authy's API (the Twilio Authy API) is explicitly deprecated and closed to new customers per Twilio's own docs, and community reports confirm there is no way to export/manage 2FA data programmatically outside the mobile/desktop UI—users describe hacky workarounds just to extract seeds. There is no evidence of a supported API that mirrors the app's UI capabilities (device management, backup, sync, disabling installs, etc.).

   • [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”
   • [community] “Authy makes it hard to migrate away. Anyone know how to get the seed of the 2FA codes? Is there really no export option?”
   • [community] “I just migrated off of Authy last week... Never liked it but they make it extremely difficult to export your data. Twilio really doesn't wan…”
   • [community] “They intentionally make it really hard to migrate your data off their app under the premise of 'security'. Now they are EOL'ing desktop apps…”
   • [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”

   proof ↗⚑ flag

   Ente Auth—none0/10

   Ente Auth exposes only a CLI for exporting/decrypting backups, not a general API covering all UI actions (add/edit/share/organize codes, etc.); probes for OpenAPI/API docs all returned 404, and no documentation describes a comprehensive API surface.

   • [probe] “PROBE openapi: all candidate paths 404 (https://ente.com/openapi.json, https://ente.com/swagger.json, https://ente.com/api/openapi.json, htt…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”
   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”

   proof ↗⚑ flag

2. ai-native userExport all of my data in open formats and leave

   weight 3 · round to Ente Auth
   Authy!disputedcontradicted2/10

   Authy provides no official open-format export tool; community reports (authy-comm-3, authy-comm-4, authy-comm-10, authy-comm-18) describe deliberately obstructed migration, requiring hacky Electron debug-mode QR dumps (authy-comm-14) rather than any documented export feature, directly contradicting any implicit claim of open portability. missing for 10: any first-party documentation of a data export feature or open format, evidence of a supported 'leave the platform' workflow, and confirmation that TOTP seeds/secrets can be retrieved without workarounds.

   • [community] “Authy makes it hard to migrate away. Anyone know how to get the seed of the 2FA codes? Is there really no export option?”
   • [community] “I just migrated off of Authy last week... Never liked it but they make it extremely difficult to export your data. Twilio really doesn't wan…”
   • [community] “They intentionally make it really hard to migrate your data off their app under the premise of 'security'. Now they are EOL'ing desktop apps…”
   • [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”
   • [community] “I will also never forgive Authy for removing desktop support with near immediate deprecation and no way to export off their platform. I will…”
   • [claimed-docs] “Use our backup feature incase you lose your phone. We encrypt your data, and only decrypt on the devices using a password only you know.”

   proof ↗⚑ flag

   Ente Auth!disputedcontradicted5/10

   Ente ships an official CLI to export and decrypt Auth data and documents password-encrypted local backups, and some HN commenters confirm easy export/import between apps (comm-6,7,8; probe-rt-1). But a first-hand HN commenter explicitly states 'You cant easily export your codes into a different format using this app, meaning that it is difficult to migrate away' (comm-2), directly contradicting the frictionless open-format export claim. Missing for 10: a documented plain/open (non-proprietary) full export format, resolution of the lock-in complaint, and independent verification that CLI-exported data is usable outside Ente.

   • [claimed-docs] “Automatic daily backups: When enabled, Ente Auth creates one local backup per day when you open the app.”
   • [claimed-docs] “Password-protected: All local backups are encrypted with a password you set. Keep this password safe, because Ente cannot recover it for you…”
   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [claimed-docs] “the data is encrypted using a key derived from the user's password”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”
   • [community] “I'm waiting for bitwarden or aegis export capability before trying this out. You cant easily export your codes into a different format using…”
   • [community] “I have been using Aegis but switched to Ente Auth as I decided to use Ente Photos as well. Both Aegis and Ente Auth are great options. This …”
   • [community] “I think it has its own backup service. But it otherwise lets you export/import your data. I feel like as long as I can do an export in some …”

   proof ↗⚑ flag

3. ai-native userRead the product's source under an open license

   weight 2 · round to Ente Auth
   Authy—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Ente Auth✓fullprobed7/10

   Ente's own llms.txt explicitly states 'Ente's apps and server are open source,' and a GitHub repo (ente/ente) is referenced for the CLI/export tooling; independent HN commentary corroborates ('thank you for releasing it open source'). Missing for 10: explicit license name/text and a direct link to the license file are not shown in the evidence pack.

   • [probe] “PROBE llms.txt: HTTP 200 at https://ente.com/llms.txt # Ente > Ente builds private, end-to-end encrypted apps for photos, two-factor authen…”
   • [probe] “PROBE runtime (recorded 2026-09-15): ente.com serves a live llms.txt — '# Ente — Ente builds private, end-to-end encrypted apps for photos, …”
   • [community] “This looks quite nice, thank you for releasing it open source... One note as I signed up for an account is that the email verification went …”
   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”

   proof ↗⚑ flag

4. ai-native userSelf-host the core product

   weight 3 · round to Ente Auth
   Authy—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Ente Auth✓fullprobed8/10

   Ente explicitly documents self-hosting instructions, pointing users to run Ente Auth at localhost/machine-ip:3003, and the product is described as open source, consistent with independent verification via the llms.txt runtime probe. missing for 10: independent hands-on report of a full self-hosted deployment (beyond docs/probe), and details on self-hosting server setup/requirements beyond the port reference.

   • [claimed-docs] “Alternatively, if using Ente Auth, get started by adding an account (assuming you are running Ente Auth at `http://<machine-ip>:3003` or `ht…”
   • [probe] “PROBE llms.txt: HTTP 200 at https://ente.com/llms.txt # Ente > Ente builds private, end-to-end encrypted apps for photos, two-factor authen…”
   • [probe] “PROBE runtime (recorded 2026-09-15): ente.com serves a live llms.txt — '# Ente — Ente builds private, end-to-end encrypted apps for photos, …”

   proof ↗⚑ flag

Storage

1. everyday userThe app stores passkeys and signs me into websites and apps with them, not just TOTP codes

   weight 3 · round drawn
   Authy—none0/10

   Evidence only shows Twilio's separate Verify API service listing 'Passkeys' as one of many verification factors developers can integrate (authy-docs-2), not that the Authy consumer app itself stores user passkeys or lets users sign into websites/apps with them. All Authy app feature docs (docs-3 through docs-12) describe only TOTP/2FA sync, backups, and device management — no passkey storage or autofill capability is mentioned, and community evidence never discusses passkey sign-in via Authy.

   • [claimed-docs] “Quickly verify users via SMS, Passkeys, Silent Network Auth, Voice, WhatsApp, TOTP, Push, Silent Device Approval, and Email.”
   • [claimed-docs] “Sync 2FA across mobile and tablet.”
   • [claimed-docs] “Use TouchID, PIN protection and passwords to protect access to your 2FA tokens.”
   • [claimed-docs] “Easily capture 2FA QR codes from Facebook, Amazon, Google, Microsoft, Dropbox and many more.”

   proof ↗⚑ flag

   Ente Auth—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Sync

1. power userMy passkeys sync across ecosystems — iOS, Android, Windows, Linux, browsers — instead of being locked to one platform vendor

   weight 2 · round drawn
   Authy—none0/10

   Authy's own docs describe syncing TOTP/2FA tokens across mobile/tablet devices (authy-docs-3, authy-docs-4), not passkeys; the only 'Passkeys' mention is in Twilio Verify API docs, which is a separate developer verification service, not evidence Authy itself stores or syncs WebAuthn passkeys across iOS/Android/Windows/Linux/browsers. No evidence shows Authy functioning as a cross-platform passkey manager.

   • [claimed-docs] “Quickly verify users via SMS, Passkeys, Silent Network Auth, Voice, WhatsApp, TOTP, Push, Silent Device Approval, and Email.”
   • [claimed-docs] “Sync 2FA across mobile and tablet.”
   • [claimed-docs] “On any device. Your phone, tablet, even your Apple Watch.”
   • [claimed-docs] “It's available for iOS, Android, macOS, Windows, and Linux.”

   proof ↗⚑ flag

   Ente Auth—none0/10

   Ente Auth is a TOTP/2FA code manager; the only passkey mention in evidence (doc-14) refers to passkey login for the separate Ente Photos account, not Ente Auth storing/syncing passkeys as credentials across iOS/Android/Windows/Linux/browsers. No evidence shows Ente Auth itself functions as a cross-platform passkey vault.

   • [claimed-docs] “Ente also offers [Legacy](/help/photos/features/legacy/) (emergency contacts) and support for [Passkeys](/help/photos/features/passkeys).”
   • [claimed-docs] “Auth has an app for every platform. Mobile, desktop and web. Your codes sync across all your devices, end-to-end encrypted.”

   proof ↗⚑ flag

Export

1. power userExport all my TOTP secrets in an open, readable format and leave for another app whenever I choose — no lock-in

   weight 3 · round to Ente Auth
   Authy!disputedcontradicted2/10

   Authy provides no official export feature for TOTP secrets, and community reports (authy-comm-3, authy-comm-4, authy-comm-10, authy-comm-18) confirm the app deliberately blocks migration/export, with users resorting to hacky workarounds like extracting keys via a deprecated Chrome extension debug mode (authy-comm-13, authy-comm-14). Docs never claim an export feature exists — only backup/sync within Authy's own ecosystem (authy-docs-5, authy-docs-3). missing for 10: any documented open/standard export format, first-party export tool, official migration path preserving secrets, and evidence contradicting the well-documented lock-in behavior.

   • [claimed-docs] “Use our backup feature incase you lose your phone. We encrypt your data, and only decrypt on the devices using a password only you know.”
   • [community] “Authy makes it hard to migrate away. Anyone know how to get the seed of the 2FA codes? Is there really no export option?”
   • [community] “I just migrated off of Authy last week... Never liked it but they make it extremely difficult to export your data. Twilio really doesn't wan…”
   • [community] “They intentionally make it really hard to migrate your data off their app under the premise of 'security'. Now they are EOL'ing desktop apps…”
   • [community] “After a lot of trouble, I was able to extract my private keys from Authy by installing their deprecated Chrome extension and using some hack…”
   • [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”
   • [community] “I will also never forgive Authy for removing desktop support with near immediate deprecation and no way to export off their platform. I will…”

   proof ↗⚑ flag

   Ente Auth!disputedcontradicted4/10

   Ente Auth does offer local encrypted backups and a CLI ('ente-cli') that can export and decrypt Auth data (docs-8/9/11, probe-rt-1), and Authy-specific tooling explicitly produces a 'plaintext export format' for importing into Ente (docs-5/40) — but this is import-facing, not an open export for leaving Ente. A hands-on community report explicitly states the opposite of the 'no lock-in' claim: 'You cant easily export your codes into a different format using this app, meaning that it is difficult to migrate away once you have already moved your codes over' (comm-2), while other users only describe importing into Ente, not exporting out to a different app's format. Missing for 10: documented open/standard export format usable directly by other authenticator apps, and independent confirmation that migrating away (not just in) is easy.

   • [claimed-docs] “Automatic daily backups: When enabled, Ente Auth creates one local backup per day when you open the app.”
   • [claimed-docs] “Password-protected: All local backups are encrypted with a password you set. Keep this password safe, because Ente cannot recover it for you…”
   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [claimed-docs] “you should type this for MacOS... This will generate a text file called authy_codes.txt, which contains your Authy codes in Ente's plaintext…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”
   • [community] “I'm waiting for bitwarden or aegis export capability before trying this out. You cant easily export your codes into a different format using…”
   • [community] “Ente has free backups and it's own encrypted export format, which sounds promissing.”

   proof ↗⚑ flag

Import

1. power userImport tokens in bulk from other authenticator apps instead of re-enrolling every account by hand

   weight 2 · round to Ente Auth
   Authy—none0/10

   Evidence shows Authy lets users add individual accounts via QR code capture (authy-docs-12) but nothing indicates a bulk import feature that pulls multiple existing tokens/accounts from other authenticator apps at once. Community evidence instead focuses on Authy making it hard to export data out, which is the opposite direction from what the story asks about.

   • [claimed-docs] “Easily capture 2FA QR codes from Facebook, Amazon, Google, Microsoft, Dropbox and many more.”
   • [community] “Authy makes it hard to migrate away. Anyone know how to get the seed of the 2FA codes? Is there really no export option?”
   • [community] “I just migrated off of Authy last week... Never liked it but they make it extremely difficult to export your data. Twilio really doesn't wan…”
   • [community] “They intentionally make it really hard to migrate your data off their app under the premise of 'security'. Now they are EOL'ing desktop apps…”

   proof ↗⚑ flag

   Ente Auth✓fullcommunity9/10

   Ente Auth has a dedicated bulk-import feature and docs listing native support for many 2FA providers (2FAS, Aegis, andOTP, Bitwarden, Google Authenticator, LastPass, Proton, Raivo OTP) plus conversion paths for others like Authy, with community testimony confirming easy export/import migration from Aegis. missing for 10: no independent hands-on walkthrough of the bulk-import UI itself, only docs and one community mention.

   • [claimed-docs] “Ente Auth natively supports imports from many 2FA providers.”
   • [claimed-docs] “Bulk import from other 2FA apps”
   • [claimed-docs] “2FAS Authenticator * Aegis Authenticator * andOTP (including encrypted backups, except MOTP) * Bitwarden * Google Authenticator * …”
   • [claimed-docs] “you might be still able to import from them by first converting the data from your old provider into these plaintext files and then importin…”
   • [claimed-docs] “you should type this for MacOS... This will generate a text file called authy_codes.txt, which contains your Authy codes in Ente's plaintext…”
   • [community] “I have been using Aegis but switched to Ente Auth as I decided to use Ente Photos as well. Both Aegis and Ente Auth are great options. This …”

   proof ↗⚑ flag

Migration

1. everyday userMoving to a new phone transfers all my tokens in one guided step

   weight 2 · round drawn
   Authy✓fullcommunity7/10

   Authy's own docs describe encrypted cloud backup, multi-device sync, and 'add new device with SMS/voice/existing device approval' as the guided path to move 2FA tokens to a new phone, which directly matches this story (authy-docs-3,4,5,10). Community comments about difficulty exporting data are about moving to a *different app*, not the in-ecosystem new-phone transfer, so they don't contradict this specific flow. Missing for 10: independent/hands-on confirmation that the new-phone restore process itself is smooth and single-step (most community friction reports concern cross-app export, not device-to-device transfer).

   • [claimed-docs] “Sync 2FA across mobile and tablet.”
   • [claimed-docs] “On any device. Your phone, tablet, even your Apple Watch.”
   • [claimed-docs] “Use our backup feature incase you lose your phone. We encrypt your data, and only decrypt on the devices using a password only you know.”
   • [claimed-docs] “Add new devices with SMS, voice or existing device approval.”
   • [community] “I started using Authy long ago because it supports multiple devices and isn't linked to any other account (Google/Microsoft).”

   proof ↗⚑ flag

   Ente Auth✓fullprobed7/10

   Ente Auth syncs codes end-to-end encrypted across all devices (docs-27, docs-34), so on a new phone a user simply logs into their existing account and their tokens reappear automatically—effectively a single guided step. Community feedback corroborates that switching devices via export/import was 'very easy' (ente-auth-comm-6), and offline-mode users can restore via password-protected local/CLI backups (docs-7, docs-8, docs-9, docs-11, ente-auth-probe-rt-1). Missing for 10: no explicit first-party step-by-step 'new phone setup/restore' walkthrough, and no independent hands-on account of the exact new-device login-and-sync flow.

   • [claimed-docs] “Auth has an app for every platform. Mobile, desktop and web. Your codes sync across all your devices, end-to-end encrypted.”
   • [claimed-docs] “Auth provides end-to-end encrypted cloud backups so you don't have to worry about losing your tokens.”
   • [claimed-docs] “Ente Auth can be used without an account by choosing **Use without backups**. In offline mode, your codes are stored only on that device.”
   • [claimed-docs] “Automatic daily backups: When enabled, Ente Auth creates one local backup per day when you open the app.”
   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [community] “I have been using Aegis but switched to Ente Auth as I decided to use Ente Photos as well. Both Aegis and Ente Auth are great options. This …”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”

   proof ↗⚑ flag

1. ai-native userChoose where my data is stored (region/residency)

   weight 2 · round to Ente Auth
   Authy—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Ente Auth~partialprobed5/10

   Ente Auth offers self-hosting instructions (running your own Ente Auth server) and an offline mode that keeps codes only on-device, both of which let a user control where their data lives rather than being forced into a fixed cloud region. However, there's no explicit region/residency selection (e.g., choosing an EU vs US data center) for its hosted cloud service. Missing for 10: explicit multi-region cloud storage options, documented data-residency guarantees for the hosted service.

   • [claimed-docs] “Alternatively, if using Ente Auth, get started by adding an account (assuming you are running Ente Auth at `http://<machine-ip>:3003` or `ht…”
   • [claimed-docs] “Ente Auth can be used without an account by choosing **Use without backups**. In offline mode, your codes are stored only on that device.”
   • [probe] “PROBE llms.txt: HTTP 200 at https://ente.com/llms.txt # Ente > Ente builds private, end-to-end encrypted apps for photos, two-factor authen…”

   proof ↗⚑ flag

2. ai-native userPrevent my data from being used to train AI models

   weight 3 · round to Ente Auth
   Authy—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Ente Auth~partialprobed5/10

   Ente Auth stores codes with end-to-end encryption, meaning Ente itself cannot access plaintext data, which structurally prevents it from being used to train AI models — but there is no explicit policy statement addressing AI training use of data. Missing for 10: an explicit AI-training data-use policy/statement, and any independent confirmation of this posture beyond the general E2E encryption claim.

   • [claimed-docs] “Auth provides end-to-end encrypted cloud backups so you don't have to worry about losing your tokens.”
   • [claimed-docs] “the data is encrypted using a key derived from the user's password”
   • [probe] “PROBE docs-md: HTTP 404 at https://ente.com/help/auth/.md”

   proof ↗⚑ flag

3. ai-native userControl data retention and deletion

   weight 2 · round to Ente Auth
   Authy—none0/10

   No documentation shows Authy giving users control over data retention/export/deletion; instead multiple independent reports describe Twilio deliberately blocking data export ('no export option', 'extremely difficult to export your data') and forcing convoluted workarounds to extract keys, the opposite of user-controlled retention/deletion.

   • [community] “Authy makes it hard to migrate away. Anyone know how to get the seed of the 2FA codes? Is there really no export option?”
   • [community] “I just migrated off of Authy last week... Never liked it but they make it extremely difficult to export your data. Twilio really doesn't wan…”
   • [community] “They intentionally make it really hard to migrate your data off their app under the premise of 'security'. Now they are EOL'ing desktop apps…”
   • [community] “After a lot of trouble, I was able to extract my private keys from Authy by installing their deprecated Chrome extension and using some hack…”
   • [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”
   • [community] “I will also never forgive Authy for removing desktop support with near immediate deprecation and no way to export off their platform. I will…”

   proof ↗⚑ flag

   Ente Auth~partialprobed7/10

   Ente Auth lets users delete/trash codes with recovery or permanent deletion (docs-18/33/38), control backup location and encryption (docs-9/10), run fully offline with no cloud retention (doc-7), and export/decrypt all data via the official CLI for full portability (docs-11, probe-rt-1). However there's no explicit documentation on cloud-side account/data deletion policies or retention periods for encrypted server backups. Missing for 10: documented cloud account deletion/retention policy, independent confirmation of full data erasure on request.

   • [claimed-docs] “You can now trash codes that you don't need. ... You can recover codes from here, in case of accidental deletions, or delete them permanentl…”
   • [claimed-docs] “You can delete or edit a code by long pressing (or right clicking on desktop) on that item.”
   • [claimed-docs] “You can now trash codes that you don't need. These items will be moved to a separate section within the app, under the "Trash" header.”
   • [claimed-docs] “Ente Auth can be used without an account by choosing **Use without backups**. In offline mode, your codes are stored only on that device.”
   • [claimed-docs] “Password-protected: All local backups are encrypted with a password you set. Keep this password safe, because Ente cannot recover it for you…”
   • [claimed-docs] “Custom backup location: Choose where to store your backups on your device.”
   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”

   proof ↗⚑ flag

4. ai-native userOpt out of telemetry and usage tracking

   weight 2 · round drawn
   Authy—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Ente Auth—none0/10

   No evidence pack mentions any telemetry, analytics, or usage-tracking settings, opt-out toggles, or privacy policy statements about data collection in Ente Auth; the evidence covers import/export, backups, and sync features only.

   ⚑ flag

App lock

1. everyday userThe app itself locks behind biometrics or a PIN, so a borrowed phone doesn't expose my codes

   weight 2 · round drawn
   Authy✓fullcommunity8/10

   Twilio's official docs claim TouchID, PIN, and password protection guarding access to 2FA tokens, and a community user independently corroborates using Face ID to lock the entire app on their phone. This directly matches the story of biometric/PIN app-lock preventing exposure on a borrowed phone. Missing for 10: more independent hands-on verification of PIN-specific lock behavior and no detail on lockout/failure edge cases.

   • [claimed-docs] “Use TouchID, PIN protection and passwords to protect access to your 2FA tokens.”
   • [community] “I use Authy with Face ID protecting the entire app on my phone... they'd still need the 2FA codes from my phone [even if password manager co…”

   proof ↗⚑ flag

   Ente Auth✓fullclaimed8/10

   Docs explicitly confirm FaceID lock (Settings → Security → Lockscreen) and a custom lock screen supporting PINs and passwords, directly matching the story's biometric/PIN app-lock requirement. missing for 10: no independent/hands-on confirmation that the lock actually blocks access on a borrowed device, and no mention of Android biometric or desktop lock parity beyond FaceID/PIN.

   • [claimed-docs] “You can enable FaceID lock under Settings → Security → Lockscreen.”
   • [claimed-docs] “You can now further protect your codes with a custom lock screen that supports PINs and passwords.”

   proof ↗⚑ flag

Audits

1. security engineerThe vendor publishes independent security audits of the app and its sync protocol

   weight 2 · round drawn
   Authy—none0/10

   The evidence pack contains no vendor claim of independent third-party security audits of the app or its sync protocol; documentation focuses on feature descriptions (SDKs, sync, backup) with no audit reports or security whitepapers cited. Community evidence discusses a data breach and a slow-to-fix vulnerability, but these do not substitute for published audit evidence and there's no vendor claim to dispute.

   ⚑ flag

   Ente Auth—none0/10

   No evidence pack item references any independent security audit of Ente Auth or its sync protocol; documentation focuses on features, encryption claims, and migration, not third-party audit reports.

   ⚑ flag

Monitoring

1. power userThe app warns me when a service I use is breached or a stored credential is weak, reused, or exposed

   weight 2 · round drawn
   Authy—none0/10

   No evidence Authy monitors for breached services, weak/reused/exposed credentials, or provides any security-posture alerts; evidence only covers 2FA sync, backup, device management, and separate breach news about Authy itself (not a feature it offers users).

   ⚑ flag

   Ente Auth—none0/10

   Ente Auth is a TOTP/HOTP authenticator app; nothing in the evidence pack shows breach-monitoring, weak/reused-credential detection, or exposure alerts — its documented features are around code storage, import/export, sharing, and lockscreen security.

   ⚑ flag

Push

1. it adminPush-based sign-in includes phishing defenses — number matching, location context, and admin-enforced MFA policies

   weight 2 · round drawn
   Authy—none0/10

   Evidence only shows generic Push and Silent Device Approval support (authy-docs-2, authy-docs-15) with no mention of number matching, location context, or admin-enforced MFA policy controls; the Authy API itself is also noted as deprecated for new integrations (authy-probe-rt-1). Missing for 10: any documentation of number matching, location-based risk signals, or admin policy enforcement for push sign-in.

   • [claimed-docs] “Quickly verify users via SMS, Passkeys, Silent Network Auth, Voice, WhatsApp, TOTP, Push, Silent Device Approval, and Email.”
   • [claimed-docs] “Push and Silent Device Approval (iOS, Android, Web)”
   • [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”

   proof ↗⚑ flag

   Ente Auth—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Server

1. it adminSelf-host the sync server on my own infrastructure and keep every secret inside my perimeter

   weight 2 · round to Ente Auth
   Authy—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Ente Auth~partialprobed6/10

   Ente explicitly documents running the Auth server locally (e.g. at http://localhost:3003) and its server code is confirmed open source, supporting self-hosting for IT admins wanting to keep secrets in-perimeter. However, the evidence pack lacks detailed self-hosting setup docs (Docker/compose instructions, hardware requirements, upgrade/security guidance) and no independent community reports specifically about self-hosting the Auth server (only cloud usage is discussed in community threads). Missing for 10: full self-hosting deployment guide, independent hands-on verification of self-hosted Auth server, and security/perimeter assurances specific to self-hosted mode.

   • [claimed-docs] “Alternatively, if using Ente Auth, get started by adding an account (assuming you are running Ente Auth at `http://<machine-ip>:3003` or `ht…”
   • [probe] “PROBE runtime (recorded 2026-09-15): ente.com serves a live llms.txt — '# Ente — Ente builds private, end-to-end encrypted apps for photos, …”
   • [probe] “PROBE llms.txt: HTTP 200 at https://ente.com/llms.txt # Ente > Ente builds private, end-to-end encrypted apps for photos, two-factor authen…”

   proof ↗⚑ flag

Source

1. security engineerThe client apps are open source, so the code handling my seeds can be inspected and community-reviewed

   weight 2 · round to Ente Auth
   Authy—none0/10

   There is no evidence Authy's client apps are open source; evidence instead shows closed, proprietary apps with deliberately obstructed export/migration paths and hacky reverse-engineering required to extract seeds. This directly contradicts the premise of community-reviewable open-source code handling seeds.

   • [community] “Authy makes it hard to migrate away. Anyone know how to get the seed of the 2FA codes? Is there really no export option?”
   • [community] “I just migrated off of Authy last week... Never liked it but they make it extremely difficult to export your data. Twilio really doesn't wan…”
   • [community] “They intentionally make it really hard to migrate your data off their app under the premise of 'security'. Now they are EOL'ing desktop apps…”
   • [community] “After a lot of trouble, I was able to extract my private keys from Authy by installing their deprecated Chrome extension and using some hack…”
   • [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”

   proof ↗⚑ flag

   Ente Auth✓fullprobed7/10

   Ente's own llms.txt explicitly states 'Ente's apps and server are open source,' and a community poster on HN independently confirms 'thank you for releasing it open source,' corroborating that the client code is publicly available for inspection. Missing for 10: a direct link/reference to the actual auth client source repo, and independent evidence of community security review or audits of the seed-handling code.

   • [probe] “PROBE runtime (recorded 2026-09-15): ente.com serves a live llms.txt — '# Ente — Ente builds private, end-to-end encrypted apps for photos, …”
   • [community] “This looks quite nice, thank you for releasing it open source... One note as I signed up for an account is that the email verification went …”

   proof ↗⚑ flag

Automation

1. ai-native userAn agent can fetch a current TOTP code programmatically — via CLI or API — to complete a 2FA login inside an automated workflow

   weight 2 · round drawn
   Authy—none0/10

   Authy is a consumer authenticator app; there is no documented CLI/API for a user or agent to programmatically fetch their own current TOTP code, and Twilio's docs confirm the Authy API is deprecated and closed to new customers with no successor for this use case. Community evidence further shows Authy intentionally blocks exporting secrets/codes, requiring hacky workarounds (deprecated Chrome extension, debug-mode Electron hacks) rather than any supported programmatic access.

   • [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”
   • [community] “Authy makes it hard to migrate away. Anyone know how to get the seed of the 2FA codes? Is there really no export option?”
   • [community] “I just migrated off of Authy last week... Never liked it but they make it extremely difficult to export your data. Twilio really doesn't wan…”
   • [community] “After a lot of trouble, I was able to extract my private keys from Authy by installing their deprecated Chrome extension and using some hack…”
   • [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”

   proof ↗⚑ flag

   Ente Auth—none0/10

   Evidence only shows a CLI for exporting/backing up and decrypting Ente Auth data (ente-auth-docs-11, ente-auth-probe-rt-1), not for programmatically retrieving a live/current TOTP code for use in an automated 2FA login. No API, CLI subcommand, or docs describe generating a real-time code for agent consumption.

   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://ente.com/openapi.json, https://ente.com/swagger.json, https://ente.com/api/openapi.json, htt…”

   proof ↗⚑ flag

2. ai-native userExpose the vault through a local programmatic endpoint an agent can query for codes and secrets without screen-scraping the app

   weight 1 · round drawn
   Authy—none0/10

   No evidence Authy offers any local programmatic endpoint for agents to query codes/secrets; its API is closed to new customers and deprecated, and community reports describe the vault as deliberately hard to export via any means other than hacky manual extraction.

   • [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”
   • [community] “After a lot of trouble, I was able to extract my private keys from Authy by installing their deprecated Chrome extension and using some hack…”
   • [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”
   • [community] “I just migrated off of Authy last week... Never liked it but they make it extremely difficult to export your data. Twilio really doesn't wan…”

   proof ↗⚑ flag

   Ente Auth—none0/10

   No evidence of any local API, IPC endpoint, or programmatic interface for querying codes; the only related tooling is the export/backup CLI (docs-11, probe-rt-1), which produces files rather than a queryable local endpoint an agent could hit live. No OpenAPI/local server documentation was found (probe-3 confirms no openapi endpoint).

   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://ente.com/openapi.json, https://ente.com/swagger.json, https://ente.com/api/openapi.json, htt…”

   proof ↗⚑ flag

Browser

1. everyday userA browser extension autofills my TOTP codes and passkeys during login instead of making me retype them

   weight 2 · round drawn
   Authy—none0/10

   Evidence pack shows no current Authy browser extension for autofilling TOTP or passkeys; the only extension mentioned is a deprecated Chrome extension used via hacky workarounds to extract keys, not autofill. Authy's own product is a mobile/desktop authenticator app, and passkey support referenced is for Twilio Verify (a separate API product), not the Authy app/extension.

   • [community] “After a lot of trouble, I was able to extract my private keys from Authy by installing their deprecated Chrome extension and using some hack…”
   • [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”
   • [claimed-docs] “Quickly verify users via SMS, Passkeys, Silent Network Auth, Voice, WhatsApp, TOTP, Push, Silent Device Approval, and Email.”

   proof ↗⚑ flag

   Ente Auth—none0/10

   No evidence of a browser extension for Ente Auth; the product is described as apps for mobile, desktop and web with manual QR-scan/setup-key entry, not autofill via a browser extension for TOTP or passkeys during login.

   ⚑ flag

Desktop

1. power userA first-class desktop app gives me codes and vault access on my computer, not just on mobile

   weight 2 · round to Ente Auth
   Authy!disputedcontradicted4/10

   Twilio's docs list Authy as available on macOS, Windows, and Linux, suggesting first-class desktop apps, but hands-on community reports concretely contradict this, stating Authy is 'EOL'ing desktop apps' with 'near immediate deprecation' and no export path, leaving the desktop surface unreliable for power users. Missing for 10: no evidence of continued desktop app support with vault/code access, no independent confirmation the desktop client remains functional or maintained post-EOL announcement.

   • [claimed-docs] “It's available for iOS, Android, macOS, Windows, and Linux.”
   • [community] “They intentionally make it really hard to migrate your data off their app under the premise of 'security'. Now they are EOL'ing desktop apps…”
   • [community] “I will also never forgive Authy for removing desktop support with near immediate deprecation and no way to export off their platform. I will…”

   proof ↗⚑ flag

   Ente Auth✓fullcommunity7/10

   Ente Auth explicitly ships native desktop clients (Flathub Linux app, plus 'app for every platform: Mobile, desktop and web' with full sync) and desktop-specific UI features like right-click code editing, matching a first-class desktop experience; a HN user corroborates switching to it specifically for its desktop app after Authy dropped theirs. missing for 10: explicit list/docs of Windows/Mac desktop builds beyond Flathub, and an independent hands-on review confirming full feature parity with mobile.

   • [claimed-docs] “Auth is now officially available on [Flathub](https://flathub.org/apps/io.ente.auth)!”
   • [claimed-docs] “Auth has an app for every platform. Mobile, desktop and web. Your codes sync across all your devices, end-to-end encrypted.”
   • [claimed-docs] “You can delete or edit a code by long pressing (or right clicking on desktop) on that item.”
   • [community] “Ente Auth is awesome - I've been using it ever since Authy discontinued their desktop app.”

   proof ↗⚑ flag

Watch

1. everyday userRead my codes from my smartwatch without pulling out my phone

   weight 1 · round to Authy
   Authy~partialprobed5/10

   Authy's own marketing page explicitly claims support on 'your phone, tablet, even your Apple Watch,' which directly matches the smartwatch-reading story, but this is a single first-party claim with no independent or hands-on confirmation of watch functionality (e.g., no community mention of using the watch app), and the API deprecation notice signals the product line is winding down. Missing for 10: independent/hands-on verification of the Apple Watch experience, detail on Wear OS or other smartwatch support, and confirmation the feature is still maintained post-deprecation.

   • [claimed-docs] “On any device. Your phone, tablet, even your Apple Watch.”
   • [claimed-docs] “Sync 2FA across mobile and tablet.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”

   proof ↗⚑ flag

   Ente Auth—none0/10

   The evidence pack covers mobile/desktop/web platform support, import/export, sharing, and lockscreen features, but contains no mention of smartwatch (e.g. Wear OS, watchOS) support or companion app for viewing codes without pulling out a phone.

   ⚑ flag

Backup

1. security engineerBackups are end-to-end encrypted with a key the vendor never holds, and the encryption design is documented

   weight 3 · round to Ente Auth
   Authy~partialcommunity4/10

   Authy's marketing page states backups are encrypted and 'only decrypt on the devices using a password only you know' (authy-docs-5), implying a vendor-can't-decrypt design, but there is no technical documentation of the encryption algorithm, key derivation, or threat model, and no independent audit confirming the vendor truly never holds the key. Community reports focus on account-takeover via device-add (authy-comm-15) and painful data export (authy-comm-13/14), not on breaking the underlying backup encryption, so this doesn't rise to a concrete dispute of the encryption claim itself. Missing for 10: a detailed whitepaper/spec of the E2E encryption scheme, key management details, and independent security audit or crypto review corroborating the zero-knowledge claim.

   • [claimed-docs] “Use our backup feature incase you lose your phone. We encrypt your data, and only decrypt on the devices using a password only you know.”
   • [community] “After a lot of trouble, I was able to extract my private keys from Authy by installing their deprecated Chrome extension and using some hack…”
   • [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”
   • [community] “The Twilio exploit allowed the hackers to add a new device to existing Authy accounts. This allowed them to sync the keys between devices wi…”

   proof ↗⚑ flag

   Ente Auth~partialprobed6/10

   Ente docs state cloud backups are end-to-end encrypted (docs-27, docs-34) and local backups are encrypted with a password-derived key that Ente cannot recover (docs-9, docs-12), plus open-source apps/server are confirmed (probe-rt-2), supporting a 'vendor never holds key' claim. However there is no detailed cryptographic design doc (key derivation algorithm, protocol specifics, audit report) in the evidence, only high-level marketing/FAQ statements. Missing for 10: a published encryption whitepaper or technical spec, and independent security audit/corroboration of the E2E design.

   • [claimed-docs] “Auth has an app for every platform. Mobile, desktop and web. Your codes sync across all your devices, end-to-end encrypted.”
   • [claimed-docs] “Auth provides end-to-end encrypted cloud backups so you don't have to worry about losing your tokens.”
   • [claimed-docs] “Password-protected: All local backups are encrypted with a password you set. Keep this password safe, because Ente cannot recover it for you…”
   • [claimed-docs] “the data is encrypted using a key derived from the user's password”
   • [probe] “PROBE runtime (recorded 2026-09-15): ente.com serves a live llms.txt — '# Ente — Ente builds private, end-to-end encrypted apps for photos, …”

   proof ↗⚑ flag

Multi device

1. everyday userMy tokens are available on my phone, tablet, and computer at the same time, kept in sync automatically

   weight 2 · round to Ente Auth
   Authy!disputedcontradicted4/10

   Docs and community confirm sync across phone/tablet (and even Apple Watch) works well and is a headline feature (authy-docs-3, authy-docs-4, authy-docs-16, authy-comm-1), but the 'computer' part of the story is directly contradicted: community reports Authy EOL'd its desktop apps, breaking the phone/tablet/computer parity the docs still describe (authy-comm-10, authy-comm-18). Missing for 10: confirmation that desktop/computer sync still functions today, and resolution of the desktop deprecation vs docs claim.

   • [claimed-docs] “Sync 2FA across mobile and tablet.”
   • [claimed-docs] “On any device. Your phone, tablet, even your Apple Watch.”
   • [claimed-docs] “It's available for iOS, Android, macOS, Windows, and Linux.”
   • [community] “I started using Authy long ago because it supports multiple devices and isn't linked to any other account (Google/Microsoft).”
   • [community] “They intentionally make it really hard to migrate your data off their app under the premise of 'security'. Now they are EOL'ing desktop apps…”
   • [community] “I will also never forgive Authy for removing desktop support with near immediate deprecation and no way to export off their platform. I will…”

   proof ↗⚑ flag

   Ente Auth✓fullcommunity8/10

   Ente Auth explicitly advertises multi-platform apps (mobile, desktop, web) with end-to-end encrypted cloud sync so codes stay in sync across devices, and community evidence corroborates real-world use across app switches without complaint about sync failures. Missing for 10: independent hands-on confirmation of real-time multi-device sync latency/reliability and any edge-case sync bugs reported by users.

   • [claimed-docs] “Auth has an app for every platform. Mobile, desktop and web. Your codes sync across all your devices, end-to-end encrypted.”
   • [claimed-docs] “Auth provides end-to-end encrypted cloud backups so you don't have to worry about losing your tokens.”
   • [community] “Ente Auth is awesome - I've been using it ever since Authy discontinued their desktop app.”
   • [community] “I have been using Aegis but switched to Ente Auth as I decided to use Ente Photos as well. Both Aegis and Ente Auth are great options. This …”

   proof ↗⚑ flag

Recovery

1. everyday userLosing my phone doesn't lose my accounts — a documented recovery path restores my tokens on a new device

   weight 3 · round to Ente Auth
   Authy✓fullcommunity7/10

   Authy's official docs describe an encrypted backup feature that restores 2FA tokens to a new device using a user-known password, plus multi-device sync and device management (authy-docs-3,4,5,8,10), and a community user confirms this recovery path works in practice after phone loss/SIM replacement (authy-comm-19). Some community friction exists around exporting data to competing apps, but that's a separate migration-away concern, not evidence the phone-loss recovery path itself fails. Missing for 10: a detailed first-party step-by-step restore walkthrough, and broader independent corroboration beyond a single community anecdote.

   • [claimed-docs] “Sync 2FA across mobile and tablet.”
   • [claimed-docs] “On any device. Your phone, tablet, even your Apple Watch.”
   • [claimed-docs] “Use our backup feature incase you lose your phone. We encrypt your data, and only decrypt on the devices using a password only you know.”
   • [claimed-docs] “View information, rename, and remove lost/stolen devices.”
   • [claimed-docs] “Add new devices with SMS, voice or existing device approval.”
   • [community] “I've been using Authy as a backup for 1Password's 2FA since in a worst-case scenario I can get a replacement SIM card and get back into my 1…”

   proof ↗⚑ flag

   Ente Auth✓fullprobed8/10

   Ente Auth documents end-to-end encrypted cloud sync/backups so codes restore on a new device after login, plus a recovery key to bypass 2FA lockouts, local encrypted backups, and a CLI export tool as additional restore paths. missing for 10: no independent hands-on account of a real device-loss recovery walkthrough, and no detail on exact steps to restore cloud-synced codes on a fresh device beyond general sync claims.

   • [claimed-docs] “Auth has an app for every platform. Mobile, desktop and web. Your codes sync across all your devices, end-to-end encrypted.”
   • [claimed-docs] “Auth provides end-to-end encrypted cloud backups so you don't have to worry about losing your tokens.”
   • [claimed-docs] “We recommend that you ensure you store your recovery key in a safe place (writing it down on a paper is a good idea). This key can be used t…”
   • [claimed-docs] “Automatic daily backups: When enabled, Ente Auth creates one local backup per day when you open the app.”
   • [claimed-docs] “Password-protected: All local backups are encrypted with a password you set. Keep this password safe, because Ente cannot recover it for you…”
   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”
   • [community] “Ente has free backups and it's own encrypted export format, which sounds promissing.”

   proof ↗⚑ flag

Automation

1. ai-native userAn agent can create and update vault entries — seeding new TOTP secrets, storing credentials — through documented programmatic surfaces

   weight 2 · round to Authy
   Authy!disputedcontradicted2/10

   Docs mention an SDK for 'the Authy API' to integrate 2FA, but Twilio's own docs page (probe) states the Authy API is closed to new customers and being deprecated with no new integrations, and multiple community reports confirm there is no supported way to programmatically seed, export, or update vault entries — users describe extreme difficulty or hacky workarounds to even extract secrets. This directly contradicts any claim of a documented programmatic surface for agent-driven vault creation/updates. Missing for 10: any current API/SDK for creating or updating TOTP vault entries, official export/import endpoints, and first-party agent integration examples.

   • [claimed-docs] “we provide an SDK for common web languages. If your language is supported, it's the fastest way to get started.”
   • [claimed-docs] “So you don't have to use the Authy API directly to integrate two-factor authentication into your app, we provide an SDK for common web langu…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”
   • [community] “Authy makes it hard to migrate away. Anyone know how to get the seed of the 2FA codes? Is there really no export option?”
   • [community] “I just migrated off of Authy last week... Never liked it but they make it extremely difficult to export your data. Twilio really doesn't wan…”
   • [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”

   proof ↗⚑ flag

   Ente Auth—none0/10

   Evidence shows only manual QR-scan/setup-key entry, GUI import/export, and a CLI limited to exporting and decrypting backups—no documented API, SDK, or CLI subcommand for programmatically creating or updating vault entries. No OpenAPI/API surface was found (ente-auth-probe-3 confirms no openapi.json), so an agent has no documented programmatic surface to seed or update TOTP secrets.

   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://ente.com/openapi.json, https://ente.com/swagger.json, https://ente.com/api/openapi.json, htt…”
   • [claimed-docs] “Scan the QR code shown by the service.”
   • [claimed-docs] “Enter the account name, issuer, and secret (setup key).”

   proof ↗⚑ flag

Policy

1. it adminEnforce org-wide policies — require app lock, restrict export, mandate strong master credentials — across every member's app

   weight 1 · round drawn
   Authy—none0/10

   Authy's evidence pack shows only consumer-facing features (per-device PIN/TouchID lock, backup password, device management) with no mention of any organization/admin console, centralized policy enforcement, or IT-admin controls across a team of users. The product is also being deprecated in favor of Verify, with no admin management surface described anywhere.

   • [claimed-docs] “Use TouchID, PIN protection and passwords to protect access to your 2FA tokens.”
   • [claimed-docs] “View information, rename, and remove lost/stolen devices.”
   • [claimed-docs] “Disable future Authy app installations for improved security.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Twilio's own docs page carries the deprecation notice verbatim — 'The Authy API is now closed to new cu…”

   proof ↗⚑ flag

   Ente Auth—none0/10

   No evidence of any org-wide admin console, centralized policy enforcement, mandated master password strength, or app lock/export restrictions applied across members — Ente Auth is a personal/individual authenticator with local lock screen (per-device) and personal backup/export options, not a managed enterprise policy tool.

   • [claimed-docs] “You can now further protect your codes with a custom lock screen that supports PINs and passwords.”
   • [claimed-docs] “Password-protected: All local backups are encrypted with a password you set. Keep this password safe, because Ente cannot recover it for you…”
   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”

   proof ↗⚑ flag

Sharing

1. it adminMy team can share TOTP-protected logins through shared vaults or collections with per-member access control

   weight 2 · round to Ente Auth
   Authy—none0/10

   Authy is a personal authenticator app with no evidence of shared vaults, collections, or per-member access control for team/admin management; evidence only covers individual multi-device sync and backup features. Community evidence even highlights difficulty exporting/sharing data at all, reinforcing the lack of team-sharing capability.

   • [claimed-docs] “Sync 2FA across mobile and tablet.”
   • [claimed-docs] “Use our backup feature incase you lose your phone. We encrypt your data, and only decrypt on the devices using a password only you know.”
   • [community] “Authy makes it hard to migrate away. Anyone know how to get the seed of the 2FA codes? Is there really no export option?”
   • [community] “I just migrated off of Authy last week... Never liked it but they make it extremely difficult to export your data. Twilio really doesn't wan…”

   proof ↗⚑ flag

   Ente Auth~partialclaimed4/10

   Ente Auth documents sharing individual TOTP codes via temporary, end-to-end encrypted links with teammates (docs-16, docs-35), and explicitly restricts sharing to TOTP (not HOTP) entries (docs-30), which covers the core 'share TOTP logins with team' idea. However there is no evidence of a vault/collection construct or per-member access control (e.g., role-based permissions, group vaults, admin-managed membership) — sharing appears to be per-code link generation rather than an admin-managed shared vault. Missing for 10: evidence of collection/vault-based sharing, per-member access control or roles, and admin management console for team access.

   • [claimed-docs] “You can now easily share specific codes with your team, with temporary links that are end-to-end encrypted.”
   • [claimed-docs] “Share codes with your team securely”
   • [claimed-docs] “Sharing is now limited to TOTP codes; the share option is hidden for HOTP entries.”

   proof ↗⚑ flag

Enrollment

1. everyday userScan a QR code and immediately start generating TOTP codes for a new account

   weight 3 · round to Ente Auth
   Authy✓fullcommunity7/10

   Authy's own product page states it can capture 2FA QR codes from major providers and lists TOTP as a supported authentication method, directly matching the scan-and-generate story, and community comments confirm ongoing everyday use of the app for this purpose. Missing for 10: a first-person hands-on account of the exact scan-to-code flow and more detailed onboarding documentation beyond the marketing feature list.

   • [claimed-docs] “Easily capture 2FA QR codes from Facebook, Amazon, Google, Microsoft, Dropbox and many more.”
   • [claimed-docs] “TOTP (Authenticator Apps)”
   • [community] “I started using Authy long ago because it supports multiple devices and isn't linked to any other account (Google/Microsoft).”
   • [community] “I've been using Authy as a backup for 1Password's 2FA since in a worst-case scenario I can get a replacement SIM card and get back into my 1…”

   proof ↗⚑ flag

   Ente Auth✓fullclaimed8/10

   Docs explicitly describe scanning a QR code shown by a service to add a new account, both generally (docs-1) and for specific migration flows (docs-6/41), which immediately generates TOTP codes in the app. This core flow is directly and simply documented as the primary onboarding method. Missing for 10: independent hands-on confirmation of the exact scan-to-code-generation moment and any UX friction reports.

   • [claimed-docs] “Scan the QR code shown by the service.”
   • [claimed-docs] “Enter the account name, issuer, and secret (setup key).”
   • [claimed-docs] “Tap the add button and scan the QR code shown by the service.”
   • [claimed-docs] “Open Ente Auth. Tap the add button and scan the QR code shown by the service.”

   proof ↗⚑ flag

Offline

1. power userCodes generate fully offline — no network, no vendor account required just to see my TOTP codes

   weight 2 · round to Ente Auth
   Authy!disputedcontradicted4/10

   Authy's own docs claim codes can be viewed without internet ('access secured websites without internet access on your phone'), but the product fundamentally requires creating a Twilio/Authy account tied to a phone number before any TOTP codes can be generated or viewed, and codes are further gated behind an app password — directly contradicting the 'no vendor account required' part of the story. Community evidence confirms this account-centric architecture (phone-number-as-username, multi-device sync tied to account, extraction of underlying seeds required hacky workarounds via a deprecated debug mode rather than a supported offline export).

   • [claimed-docs] “You can still access secured websites without internet access on your phone.”
   • [community] “I started using Authy long ago because it supports multiple devices and isn't linked to any other account (Google/Microsoft).”
   • [community] “This doesn't scare me because in Authy you also set a password which without you cannot access the codes. The phone number here just acts as…”
   • [community] “After a lot of trouble, I was able to extract my private keys from Authy by installing their deprecated Chrome extension and using some hack…”
   • [community] “Note how insane the Authy export instructions are: 'Paste in a bunch of code to an Electron app running Authy in debug mode to dump the toke…”
   • [community] “services with Authy-integrated MFA (like Twitch) are 'managed' by Authy so it can regenerate the secret on the fly; your previously extracte…”

   proof ↗⚑ flag

   Ente Auth✓fullclaimed8/10

   Docs explicitly confirm offline mode with no account required, codes stored only on-device, and no network dependency for viewing codes. Missing for 10: independent hands-on verification (e.g. airplane-mode test) beyond vendor docs, and no detail on how backups/imports work fully offline without any cloud touchpoint.

   • [claimed-docs] “Ente Auth can be used without an account by choosing **Use without backups**. In offline mode, your codes are stored only on that device.”
   • [claimed-docs] “Use without an account”

   proof ↗⚑ flag

Organization

1. power userKeep dozens of tokens organized — search, folders or groups, and service icons — so the right code is always two taps away

   weight 2 · round to Ente Auth
   Authy—none0/10

   Evidence shows only basic token/QR capture (service icons implied) with no mention of search or folder/group organization; a community user explicitly complains 'can't we please have alphabetization?' indicating the app lacks even simple sorting, let alone search/folders for power users managing dozens of tokens.

   • [claimed-docs] “Easily capture 2FA QR codes from Facebook, Amazon, Google, Microsoft, Dropbox and many more.”
   • [community] “My guess is that most of the people who worked on Authy have fallen by the wayside after the Twilio acquisition. It's annoying every time I …”

   proof ↗⚑ flag

   Ente Auth~partialclaimed6/10

   Ente Auth's marketing docs confirm search (deep-link search feature), service icons, and favoriting/organizing features ('Organize with ease', 'Favorite services to the top', 'Don't scroll'), directly supporting quick access to tokens. However, there is no concrete evidence of folder or group/category organization for large token sets — only vague 'organize with ease' copy and free-text notes (500-char annotations), not structured grouping. Missing for 10: explicit folder/category/tagging feature documentation, evidence of grouping many tokens, independent hands-on confirmation of organization UX at scale.

   • [claimed-docs] “Save time by viewing your next code”
   • [claimed-docs] “Easily identify your tokens by their icons”
   • [claimed-docs] “Organize with ease”
   • [claimed-docs] “Favorite services to the top”
   • [claimed-docs] “Don't scroll”
   • [claimed-docs] “Added support for search deep links via enteauth://search.”
   • [claimed-docs] “You can attach any text (upto a maximum of 500 characters), to provide more information about your accounts.”

   proof ↗⚑ flag

Variants

1. power userNon-standard tokens work too — Steam Guard, HOTP counters, custom periods and digit lengths

   weight 2 · round to Ente Auth
   Authy—none0/10

   No evidence anywhere in the pack mentions Steam Guard support, HOTP counter-based tokens, or custom period/digit configurations; documentation only references standard TOTP and QR-code capture from mainstream services. Absence of evidence for this applicable power-user axis yields 'none'.

   ⚑ flag

   Ente Auth~partialclaimed4/10

   Evidence confirms HOTP entries are supported (the changelog notes sharing is now limited to TOTP and hidden for HOTP entries), implying native HOTP counter support. However, there is no mention anywhere in the evidence pack of Steam Guard token support, or of custom period/digit-length configuration for TOTP entries. missing for 10: explicit Steam Guard support, custom period/digit-length configuration, and any hands-on confirmation beyond the changelog note.

   • [claimed-docs] “Sharing is now limited to TOTP codes; the share option is hidden for HOTP entries.”

   proof ↗⚑ flag