Microsoft Authenticator vs 2FAS

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round to 2FAS
   Microsoft Authenticator—none0/10

   Probes show no llms.txt, no markdown docs, and no OpenAPI spec available for Microsoft Authenticator's documentation site; there is no evidence of agent-oriented documentation format.

   • [probe] “PROBE llms.txt: HTTP 404 at https://support.microsoft.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://support.microsoft.com/en-us/authenticator/microsoft-authenticator-faqs.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://support.microsoft.com/openapi.json, https://support.microsoft.com/swagger.json, https://supp…”

   proof ↗⚑ flag

   2FAS✓fullprobed9/10

   Direct probe confirms a live llms.txt with an explicit 'For AI agents' section, plus modular per-section llms files, llms-full.txt, per-page .md mirrors, and Accept: text/markdown rendering — strong first-party agent-oriented docs infrastructure verified via runtime probes. Missing for 10: no independent/community corroboration of agents actually consuming these docs in practice.

   • [probe] “PROBE llms.txt: HTTP 200 at https://2fas.com/llms.txt # 2FAS — Password Manager and Authenticator > Local-first password manager (2FAS Pass…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE runtime (recorded 2026-09-15): machine-readable pricing verified live at https://2fas.com/.well-known/pricing.md — '# 2FAS Pricing... …”

   proof ↗⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round drawn
   Microsoft Authenticator—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   2FAS—none0/10

   2FAS is a mobile authenticator/password manager with no CLI, headless mode, or API for CI/automation; the product's own llms.txt explicitly declares 'Public API: None' and is local-first by design, meaning it cannot be run headlessly or scripted in CI.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

3. ai-native userConnect an agent via an official MCP server

   weight 3 · round drawn
   Microsoft Authenticator—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   2FAS—none0/10

   2FAS is a password/2FA manager, not an agent, so an MCP server axis could plausibly apply to its ecosystem; however evidence explicitly states 'Public API: None' and no OpenAPI/MCP endpoint exists, with probes confirming no API surface for agents to connect to.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

4. ai-native userUse an official CLI

   weight 2 · round drawn
   Microsoft Authenticator—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   2FAS—none0/10

   2FAS is a mobile/browser 2FA and password-manager app with no evidence of an official CLI; docs explicitly note 'Public API: None' and no CLI tool is mentioned anywhere in the evidence pack.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

5. ai-native userDrive the product through a documented public API

   weight 3 · round drawn
   Microsoft Authenticator—none0/10

   Microsoft Authenticator is a consumer mobile app with no evidence of a documented public API for programmatic/AI-driven control; probes for llms.txt, docs-md, and OpenAPI specs all returned 404s.

   • [probe] “PROBE llms.txt: HTTP 404 at https://support.microsoft.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://support.microsoft.com/en-us/authenticator/microsoft-authenticator-faqs.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://support.microsoft.com/openapi.json, https://support.microsoft.com/swagger.json, https://supp…”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS explicitly states 'Public API: None' in its own llms.txt, and OpenAPI/swagger probes all return 404, confirming there is no documented public API to drive the product programmatically — it is local-first by design.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

6. ai-native userIssue scoped/least-privilege API credentials for an agent

   weight 2 · round drawn
   Microsoft Authenticator—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   2FAS—none0/10

   2FAS is a local-first authenticator/password manager with no public API; its own llms.txt explicitly states 'Public API: None' and no agent-callable endpoint for token generation, so there is no mechanism to issue scoped/least-privilege API credentials for an agent.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

7. ai-native userBuild against official SDKs

   weight 2 · round drawn
   Microsoft Authenticator—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   2FAS—none0/10

   2FAS explicitly declares 'Public API: None' and has no OpenAPI/SDK endpoints; probes confirm no SDK or API surface exists for developers to build against.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

Agentic features

1. ai-native userSet up automations that run autonomously in the background

   weight 2 · round drawn
   Microsoft Authenticator—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   2FAS—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

2. ai-native userOperate the product with natural-language commands

   weight 2 · round drawn
   Microsoft Authenticator—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   2FAS—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Api quality

1. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round drawn
   Microsoft Authenticator—none0/10

   Microsoft Authenticator is a consumer mobile app for authentication, not an API product, and no OpenAPI/machine-readable spec is offered; probes for openapi.json, llms.txt, and docs-md endpoints all returned 404.

   • [probe] “PROBE llms.txt: HTTP 404 at https://support.microsoft.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://support.microsoft.com/en-us/authenticator/microsoft-authenticator-faqs.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://support.microsoft.com/openapi.json, https://support.microsoft.com/swagger.json, https://supp…”

   proof ↗⚑ flag

   2FAS—none0/10

   Direct probes for OpenAPI/swagger specs all returned 404, and the product's own llms.txt explicitly states 'Public API: None,' confirming no machine-readable API spec is offered.

   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

2. ai-native userRely on versioned APIs with a documented deprecation policy

   weight 2 · round drawn
   Microsoft Authenticator—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   2FAS—none0/10

   2FAS explicitly declares 'Public API: None' and has no OpenAPI/swagger endpoints (all probes 404), meaning there is no versioned API at all, let alone a documented deprecation policy.

   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round drawn
   Microsoft Authenticator—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   2FAS—none0/10

   2FAS is a local-first authenticator/password manager with no public API (explicitly declared 'Public API: None'), and no evidence of bulk operations across items (e.g., batch import/export beyond single-file import, bulk edit/delete of tokens or vault entries) that an AI agent could invoke. There's no scripting, CLI, or API surface for programmatic bulk actions.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [claimed-docs] “We support imports from Aegis, Raivo, LastPassAegis, Stratum (formerly Authenticator Pro) and Google Authenticator.”

   proof ↗⚑ flag

1. ai-native userDo everything through the API that I can do in the UI

   weight 2 · round drawn
   Microsoft Authenticator—none0/10

   Microsoft Authenticator is a consumer mobile app with no evidence of any public API for programmatic control of authentication actions; probes for API/docs endpoints all 404. No evidence supports API parity with UI functionality.

   • [probe] “PROBE llms.txt: HTTP 404 at https://support.microsoft.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://support.microsoft.com/en-us/authenticator/microsoft-authenticator-faqs.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://support.microsoft.com/openapi.json, https://support.microsoft.com/swagger.json, https://supp…”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS's own llms.txt explicitly declares 'Public API: None' and probes confirm no OpenAPI/swagger spec exists at any candidate path, meaning there is no API surface at all through which a user could replicate UI actions.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

2. ai-native userExport all of my data in open formats and leave

   weight 3 · round to 2FAS
   Microsoft Authenticator~partialcommunity3/10

   Microsoft documents an 'Export Passwords' feature for autofill data, but this covers only saved passwords, not the OTP/account seeds this app is centrally used for; TOTP/account data is only preserved via proprietary encrypted 'Cloud Backup' tied to a Microsoft account, not an open, portable format. Community evidence goes further, describing non-standard QR codes that other TOTP clients reject and users switching to open-source alternatives (Aegis) specifically because Authenticator lacks true open-format export/backup. missing for 10: open-format export of TOTP secrets/accounts, documented data-portability/leave workflow, independent confirmation that exported data works outside Microsoft's ecosystem.

   • [claimed-docs] “Scroll down to the Autofill section and select Export Passwords.”
   • [claimed-docs] “Turn on the Cloud Backup toggle. Select a Microsoft personal account where the backup will be stored.”
   • [claimed-docs] “Scroll down to the Autofill section and select Export Passwords... Import your passwords.”
   • [community] “Even for Microsoft accounts, use an alternative app for 2FA/MFA. Recently I switched to the open source Aegis, which allows encrypted backup…”
   • [community] “people pick MS Authenticator - it's because microsoft basically forces it on you, uses dark patterns to avoid letting you use any other stan…”

   proof ↗⚑ flag

   2FAS~partialcommunity6/10

   2FAS explicitly supports exporting/backing up data (encrypted export files, self-host freedom, import/export in free tier) and even imports from competitor formats, showing some portability. However, there's no evidence the export format itself is documented as an open/standard schema (e.g., JSON spec or standard otpauth migration format), and the backup is typically encrypted for 2FAS's own re-import rather than a documented open format for third-party tools. missing for 10: explicit open/standard export format spec, independent confirmation the exported file is usable outside 2FAS ecosystem, and details on the exact format encoding.

   • [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
   • [claimed-docs] “Freedom to self-host your data”
   • [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
   • [community] “Free tier of 2FAS Pass includes auto-fill, import/export, and standard password generator; paid tier adds multi-device sync, more than 200 v…”
   • [claimed-docs] “We support imports from Aegis, Raivo, LastPassAegis, Stratum (formerly Authenticator Pro) and Google Authenticator.”

   proof ↗⚑ flag

3. ai-native userRead the product's source under an open license

   weight 2 · round to 2FAS
   Microsoft Authenticator—none0/10

   Microsoft Authenticator is closed-source proprietary software; no evidence of any open-license source availability, and probes for docs/API artifacts also failed.

   • [probe] “PROBE llms.txt: HTTP 404 at https://support.microsoft.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://support.microsoft.com/en-us/authenticator/microsoft-authenticator-faqs.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://support.microsoft.com/openapi.json, https://support.microsoft.com/swagger.json, https://supp…”

   proof ↗⚑ flag

   2FAS✓fullprobed8/10

   2FAS explicitly points to its GitHub repositories for both the auth app and browser extension, describing itself as open-source, and the probe confirms 'open-source two-factor authentication' positioning with 'Freedom to self-host your data.' missing for 10: explicit license name (e.g., MIT/GPL) is not stated in evidence, and no independent audit confirming license terms.

   • [claimed-docs] “You can easily take a look at our code - reflecting our transparent and user-first approach. Check out our GitHub repository”
   • [claimed-docs] “Join our GitHub project and contribute to 2FAS by running code review and committing your ideas.”
   • [claimed-docs] “Check out our GitHub repository and delve deep into the intricacies of the browser extension back-end.”
   • [claimed-docs] “Freedom to self-host your data”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

4. ai-native userSelf-host the core product

   weight 3 · round to 2FAS
   Microsoft Authenticator—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   2FAS~partialcommunity6/10

   2FAS explicitly markets 'Freedom to self-host your data' and lets users choose their own cloud/WebDAV/external drive storage for vaults, and the core apps are open-source on GitHub for self-hosting/auditing. However, this is self-hosting of data/storage, not the full core service (no self-hostable server/backend, no API for self-managed infrastructure), and community commentary questions how this differs meaningfully from server-reliant competitors. Missing for 10: a self-hostable backend/server component, documentation of running the whole product on own infrastructure, and independent confirmation that self-hosted storage removes all vendor dependency.

   • [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
   • [claimed-docs] “Freedom to self-host your data”
   • [claimed-docs] “You can easily take a look at our code - reflecting our transparent and user-first approach. Check out our GitHub repository”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”

   proof ↗⚑ flag

Storage

1. everyday userThe app stores passkeys and signs me into websites and apps with them, not just TOTP codes

   weight 3 · round drawn
   Microsoft Authenticator—none0/10

   The evidence pack describes password-based sign-in removal, TOTP codes, push notifications, and password autofill/export, but nowhere mentions passkeys (FIDO2/WebAuthn credentials) being stored or used to sign into websites/apps. Missing for 10: any documentation of passkey creation, storage, or sign-in via Authenticator, and any independent confirmation of passkey support.

   • [claimed-docs] “Microsoft Authenticator is a free app that helps you sign in to all your accounts without using a password - just use a fingerprint, face re…”
   • [claimed-docs] “As the only way to sign in - just tap an approval on your phone to sign in. This is called going passwordless.”
   • [claimed-docs] “As a way to sign in every time, by using a one-time password code to increase account security. This is called two-step verification or mult…”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS is a TOTP authenticator (2FAS Auth) and separately a password manager (2FAS Pass); evidence covers token/2FA codes, vault items, and password autofill, but nothing describes passkey (WebAuthn/FIDO2) storage or passkey-based sign-in to websites/apps.

   ⚑ flag

Sync

1. power userMy passkeys sync across ecosystems — iOS, Android, Windows, Linux, browsers — instead of being locked to one platform vendor

   weight 2 · round drawn
   Microsoft Authenticator—none0/10

   The evidence pack covers Microsoft Authenticator's TOTP codes, push-notification MFA, cloud backup, and password autofill (now being discontinued), but contains no mention of passkey creation, storage, or cross-platform/cross-vendor passkey syncing across iOS, Android, Windows, Linux, or browsers. Passkey sync is a fair axis for an authenticator app, but nothing in the pack demonstrates it.

   • [claimed-docs] “This article describes how to back up information on all the accounts you have in Authenticator so that if you lose your mobile or get a new…”
   • [claimed-docs] “Turn on the Cloud Backup toggle. Select a Microsoft personal account where the backup will be stored.”
   • [community] “Microsoft Authenticator--a mobile app that provides 2FA--is discontinuing its password autofill feature and the passwords stored/used with t…”

   proof ↗⚑ flag

   2FAS—none0/10

   The evidence pack describes 2FAS Auth's 2FA token sync and 2FAS Pass's password vault sync (iCloud, Google Drive, WebDAV, browser extension) but contains no mention of 'passkey' or WebAuthn/FIDO2 credential support or storage anywhere. Since passkey sync is a distinct capability from OTP tokens or password items, there's no evidence this product delivers it.

   ⚑ flag

Export

1. power userExport all my TOTP secrets in an open, readable format and leave for another app whenever I choose — no lock-in

   weight 3 · round to 2FAS
   Microsoft Authenticator—none0/10

   Docs describe cloud backup/restore and password export/import, but none of this covers exporting TOTP secrets in an open format for use in another app; community evidence explicitly states Microsoft issues non-standard QR codes that other TOTP clients reject, indicating deliberate lock-in rather than portability.

   • [claimed-docs] “This article describes how to back up information on all the accounts you have in Authenticator so that if you lose your mobile or get a new…”
   • [claimed-docs] “Turn on the Cloud Backup toggle. Select a Microsoft personal account where the backup will be stored.”
   • [claimed-docs] “Scroll down to the Autofill section and select Export Passwords.”
   • [community] “people pick MS Authenticator - it's because microsoft basically forces it on you, uses dark patterns to avoid letting you use any other stan…”
   • [community] “Even for Microsoft accounts, use an alternative app for 2FA/MFA. Recently I switched to the open source Aegis, which allows encrypted backup…”

   proof ↗⚑ flag

   2FAS~partialclaimed6/10

   2FAS explicitly supports imports from other apps (Aegis, Raivo, Google Authenticator, etc.) and offers 2FAS export files for backup/sync, with optional password-based encryption of backups. However, evidence doesn't confirm the export format is an open/readable standard (e.g., plaintext otpauth URIs or documented JSON schema) rather than a proprietary encrypted blob, and there's no explicit statement about exporting TO other apps' formats for migration away from 2FAS. missing for 10: documented open/standard export format spec, explicit 'export to other apps' migration path, independent confirmation the export file is human-readable/portable.

   • [claimed-docs] “We support imports from Aegis, Raivo, LastPassAegis, Stratum (formerly Authenticator Pro) and Google Authenticator.”
   • [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”

   proof ↗⚑ flag

Import

1. power userImport tokens in bulk from other authenticator apps instead of re-enrolling every account by hand

   weight 2 · round to 2FAS
   Microsoft Authenticator—none0/10

   The evidence pack only covers backing up/restoring Authenticator's own accounts via cloud backup, exporting passwords, and standard account setup via QR/manual entry — there is no mention of any bulk-import feature for pulling tokens from other authenticator apps (e.g., Google Authenticator, Aegis) into Microsoft Authenticator. Community evidence even suggests the opposite direction problem (comm-6: MS's QR codes are non-standard so other apps reject them), reinforcing that cross-app portability isn't supported.

   • [claimed-docs] “This article describes how to back up information on all the accounts you have in Authenticator so that if you lose your mobile or get a new…”
   • [claimed-docs] “Turn on the Cloud Backup toggle. Select a Microsoft personal account where the backup will be stored.”
   • [community] “people pick MS Authenticator - it's because microsoft basically forces it on you, uses dark patterns to avoid letting you use any other stan…”

   proof ↗⚑ flag

   2FAS~partialclaimed6/10

   2FAS docs explicitly list bulk import support from Aegis, Raivo, LastPassAegis, Stratum, and Google Authenticator, directly supporting the power-user portability story. However, the list is limited to a handful of named apps, no evidence of a generic/universal import format (e.g., OTP URI batch, QR export from arbitrary apps), and no independent hands-on verification of the import process working smoothly. Missing for 10: broader import coverage beyond five named apps, independent/community confirmation of successful bulk import, and details on edge cases (e.g., failed imports, partial data loss).

   • [claimed-docs] “We support imports from Aegis, Raivo, LastPassAegis, Stratum (formerly Authenticator Pro) and Google Authenticator.”

   proof ↗⚑ flag

Migration

1. everyday userMoving to a new phone transfers all my tokens in one guided step

   weight 2 · round to 2FAS
   Microsoft Authenticator!disputedcontradicted5/10

   Docs describe a guided backup/restore flow (enable Cloud Backup, then restore accounts on a new device) via microsoft-authenticator-docs-9/13, which is the core mechanism for the story. However, hands-on community evidence reports the process failing catastrophically — one user's update wiped all data and locked them out of every account (microsoft-authenticator-comm-1), while another user reports no such issue (microsoft-authenticator-comm-2), showing the reliability of the 'one guided step' transfer is contested rather than confirmed. Missing for 10: independent verification that restore reliably works across devices/OS versions, and no acknowledgment/fix from Microsoft for the reported data-loss bug.

   • [claimed-docs] “This article describes how to back up information on all the accounts you have in Authenticator so that if you lose your mobile or get a new…”
   • [claimed-docs] “Turn on the Cloud Backup toggle. Select a Microsoft personal account where the backup will be stored.”
   • [community] “This happened to me when I updated MS Authenticator after not updating it for a while. It wiped out all data, and I got locked out of all ac…”
   • [community] “I've been using Microsoft's one for my work accounts... I've never gotten that dialog, and have not had any issues with the accounts I've ad…”

   proof ↗⚑ flag

   2FAS✓fullclaimed7/10

   2FAS Auth supports iCloud/Google Drive sync and encrypted export/backup files, letting a user restore tokens on a new device by simply enabling sync or importing the backup file, and 2FAS Pass has a dedicated recovery flow for restoring the vault on a different device via iCloud/Google Drive backups. missing for 10: a documented single-tap 'migrate to new phone' wizard UI and independent hands-on confirmation of the transfer experience.

   • [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
   • [claimed-docs] “Multi-device sync (encrypted)”
   • [claimed-docs] “Learn how to restore access to your 2FAS Pass Vault or run it on a different device.”
   • [claimed-docs] “If you have enabled sync with iCloud (on iOS) or Google Drive (on Android), your encrypted 2FAS Pass Vault file is right there.”

   proof ↗⚑ flag

1. ai-native userChoose where my data is stored (region/residency)

   weight 2 · round to 2FAS
   Microsoft Authenticator—none0/10

   No evidence Microsoft Authenticator offers any data residency/region selection controls for AI-native users; this is an authentication app, not a data-storage platform, but the story is arguably still applicable since it stores backups (cloud backup, account data) somewhere. No documentation mentions region choice or residency options.

   ⚑ flag

   2FAS~partialcommunity7/10

   2FAS is local-first: users choose to keep data on-device, in their own iCloud/Google Drive, WebDAV, or fully self-hosted, giving strong control over storage location (2fas-docs-5, 2fas-docs-14, 2fas-docs-17). This satisfies the spirit of data residency choice, though it's not a formal 'select region/datacenter' feature and relies on user-configured third-party clouds rather than a first-party regional hosting option. Missing for 10: explicit region/datacenter selection controls, independent verification of self-host setup beyond marketing pages.

   • [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
   • [claimed-docs] “Freedom to self-host your data”
   • [claimed-docs] “Multi-device sync (encrypted)”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”

   proof ↗⚑ flag

2. ai-native userPrevent my data from being used to train AI models

   weight 3 · round to 2FAS
   Microsoft Authenticator—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   2FAS~partialprobed4/10

   2FAS is local-first with explicit 'no telemetry' claims and no public API for data collection (2fas-probe-rt-1, 2fas-probe-rt-2), which implies user data isn't centrally harvested and thus couldn't feed AI training pipelines. However, there is no explicit statement addressing AI model training or an opt-out policy specifically. Missing for 10: explicit AI-training data policy/opt-out statement, independent confirmation that no data is ever sent to third-party AI services.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE runtime (recorded 2026-09-15): machine-readable pricing verified live at https://2fas.com/.well-known/pricing.md — '# 2FAS Pricing... …”

   proof ↗⚑ flag

3. ai-native userControl data retention and deletion

   weight 2 · round to 2FAS
   Microsoft Authenticator~partialcommunity3/10

   The app offers a toggle for sharing non-personal usage data and lets users enable/disable cloud backup or export/delete stored passwords, giving some control over what data is retained, but there is no documented account/data deletion policy, retention period, or explicit 'delete my data' feature, and community reports note unexpected data loss/location tracking rather than user-controlled retention. missing for 10: explicit data retention/deletion policy, dedicated 'delete my account data' control, independent verification that deletion actually removes backend data.

   • [claimed-docs] “You can also allow the sharing of additional non-personal usage data by turning on the "Usage Data" toggle button on the app's Settings page…”
   • [claimed-docs] “Turn on the Cloud Backup toggle. Select a Microsoft personal account where the backup will be stored.”
   • [claimed-docs] “This article describes how to back up information on all the accounts you have in Authenticator so that if you lose your mobile or get a new…”
   • [community] “It also tracks your position all the time. That is the bigger problem to me. [exodus-privacy report on com.azure.authenticator]”
   • [community] “This happened to me when I updated MS Authenticator after not updating it for a while. It wiped out all data, and I got locked out of all ac…”

   proof ↗⚑ flag

   2FAS~partialprobed6/10

   2FAS gives users explicit control over where data is stored (own cloud, external drive, self-hosting) and confirms no telemetry/tracking, which supports retention control (2fas-docs-5, 2fas-docs-14, 2fas-probe-rt-2). However there is no explicit documentation of a deletion/erasure workflow, data-retention policy, or account-deletion mechanism beyond implied local file control. Missing for 10: explicit data deletion/right-to-erasure documentation, retention period policy, and independent confirmation that deleting local/cloud copies fully removes data.

   • [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
   • [claimed-docs] “Freedom to self-host your data”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
   • [probe] “PROBE runtime (recorded 2026-09-15): machine-readable pricing verified live at https://2fas.com/.well-known/pricing.md — '# 2FAS Pricing... …”

   proof ↗⚑ flag

4. ai-native userOpt out of telemetry and usage tracking

   weight 2 · round to 2FAS
   Microsoft Authenticator!disputedcontradicted4/10

   Microsoft's own docs mention an opt-in 'Usage Data' toggle that lets users control sharing of additional non-personal usage data, suggesting some telemetry control (microsoft-authenticator-docs-16). However, independent community reporting citing an Exodus Privacy audit says the app 'tracks your position all the time,' contradicting the notion that users can fully opt out of tracking (microsoft-authenticator-comm-5), and there is no documentation of a comprehensive telemetry/diagnostics opt-out beyond that single toggle. Missing for 10: explicit documentation of a full telemetry/diagnostics opt-out, first-party clarification of the location-tracking discrepancy, and independent verification that the toggle actually stops all usage tracking.

   • [claimed-docs] “You can also allow the sharing of additional non-personal usage data by turning on the "Usage Data" toggle button on the app's Settings page…”
   • [community] “It also tracks your position all the time. That is the bigger problem to me. [exodus-privacy report on com.azure.authenticator]”

   proof ↗⚑ flag

   2FAS✓fullprobed8/10

   2FAS explicitly states in its machine-readable pricing/docs that 2FAS Auth has 'no advertising, no telemetry,' meaning tracking is absent by design rather than requiring opt-out, and the product is positioned as local-first/open-source, reinforcing a privacy-first posture. Missing for 10: no explicit dedicated privacy-settings toggle documentation, and no independent audit confirming zero telemetry across 2FAS Pass as well as Auth.

   • [probe] “PROBE runtime (recorded 2026-09-15): machine-readable pricing verified live at https://2fas.com/.well-known/pricing.md — '# 2FAS Pricing... …”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

App lock

1. everyday userThe app itself locks behind biometrics or a PIN, so a borrowed phone doesn't expose my codes

   weight 2 · round to Microsoft Authenticator
   Microsoft Authenticator✓fullclaimed8/10

   Docs explicitly describe App Lock requiring device PIN or biometric authentication every time Authenticator is opened, directly matching the story. Missing for 10: independent/hands-on confirmation of App Lock reliability and default-on status.

   • [claimed-docs] “When App Lock is enabled, you'll be asked to authenticate using your device PIN or biometric every time you open Authenticator.”
   • [claimed-docs] “Microsoft Authenticator is a free app that helps you sign in to all your accounts without using a password - just use a fingerprint, face re…”

   proof ↗⚑ flag

   2FAS—none0/10

   The evidence pack describes 2FAS Pass's tiered security and sync options, and confirms access to the browser extension/autofill must be approved in-app, but nowhere states that the 2FAS Auth or Pass app itself can be locked behind biometrics or a PIN to block access if the phone is borrowed. No docs or community evidence mention an app-lock/biometric-gate feature for the authenticator itself.

   • [claimed-docs] “2FAS Pass supports 3 Security Tiers for protecting your Items.”
   • [claimed-docs] “Access through the Browser Extension or using Autofill must be confirmed in 2FAS Pass.”

   proof ↗⚑ flag

Audits

1. security engineerThe vendor publishes independent security audits of the app and its sync protocol

   weight 2 · round drawn
   Microsoft Authenticator—none0/10

   No evidence of any published independent security audit of Microsoft Authenticator or its sync protocol; documentation only covers feature descriptions, and community threads discuss bugs, privacy concerns, and forced adoption but never an audit report. Missing for 10: any third-party audit report, pen-test disclosure, or vendor reference to an independent security assessment of the app or backup/sync protocol.

   • [claimed-docs] “This article describes how to back up information on all the accounts you have in Authenticator so that if you lose your mobile or get a new…”
   • [claimed-docs] “Turn on the Cloud Backup toggle. Select a Microsoft personal account where the backup will be stored.”
   • [community] “Even for Microsoft accounts, use an alternative app for 2FA/MFA. Recently I switched to the open source Aegis, which allows encrypted backup…”
   • [community] “It also tracks your position all the time. That is the bigger problem to me. [exodus-privacy report on com.azure.authenticator]”

   proof ↗⚑ flag

   2FAS—none0/10

   Evidence shows only open-source code availability claims and general transparency messaging, with no mention of independent third-party security audits of the app or its sync protocol; community discussion even questions the trust model of cloud-based sync without referencing any audit report.

   • [claimed-docs] “You can easily take a look at our code - reflecting our transparent and user-first approach. Check out our GitHub repository”
   • [claimed-docs] “Join our GitHub project and contribute to 2FAS by running code review and committing your ideas.”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”

   proof ↗⚑ flag

Monitoring

1. power userThe app warns me when a service I use is breached or a stored credential is weak, reused, or exposed

   weight 2 · round drawn
   Microsoft Authenticator—none0/10

   No evidence that Microsoft Authenticator monitors for breached services or evaluates stored credentials for weakness/reuse/exposure; its password autofill feature is even being discontinued rather than expanded with security scanning. Missing for 10: breach monitoring, weak/reused password detection, exposed credential alerts.

   • [community] “Microsoft Authenticator--a mobile app that provides 2FA--is discontinuing its password autofill feature and the passwords stored/used with t…”

   proof ↗⚑ flag

   2FAS—none0/10

   No evidence of breach monitoring, weak/reused/exposed password detection, or security-posture alerts anywhere in the docs, community reports, or probes; 2FAS's evidence covers sync, tiers, self-hosting, and import/export but nothing about credential health warnings or breach alerts.

   ⚑ flag

Push

1. it adminPush-based sign-in includes phishing defenses — number matching, location context, and admin-enforced MFA policies

   weight 2 · round to Microsoft Authenticator
   Microsoft Authenticator~partialcommunity5/10

   Evidence confirms admin-enforced push MFA policies (docs-3, comm-8, comm-9) and location-based context checks (docs-15), but there is no explicit mention of number matching as a phishing-resistant feature anywhere in the pack, and community threads focus on other issues (backup bugs, forced adoption) rather than validating anti-phishing controls. Missing for 10: number matching feature documentation, independent verification of phishing-resistance efficacy, and conditional access/policy configuration details for admins.

   • [claimed-docs] “You can set up notifications for your work or school account (if allowed by your administrator) or for your personal Microsoft account.”
   • [claimed-docs] “You'll need to share your location once every hour to ensure you're still within a country where you are allowed to access the resource.”
   • [community] “IME some MS shops enforce use of it for 2fa to access company resources like vpn and etc. - for eg, the only reason this app exists on my ph…”
   • [community] “My company used to allow TOTP so many TOTP apps could be used instead of Microsoft Authenticator but my company disabled that a while ago. N…”

   proof ↗⚑ flag

   2FAS—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Server

1. it adminSelf-host the sync server on my own infrastructure and keep every secret inside my perimeter

   weight 2 · round to 2FAS
   Microsoft Authenticator—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   2FAS~partialcommunity4/10

   2FAS advertises 'freedom to self-host your data' and lets users choose where encrypted vault/token data lives (own cloud, WebDAV, external drive) rather than relying on 2FAS-hosted storage, which partially satisfies the perimeter-control need. However there is no evidence of an actual downloadable/self-hostable 'sync server' component (e.g. a Vaultwarden-style server binary) — it's more bring-your-own-storage for encrypted files/backups, and community commentary explicitly questions whether this differs meaningfully from relying on third-party server infrastructure. Missing for 10: a dedicated self-hosted sync-server artifact/deployment docs, and independent confirmation that all sync traffic stays fully within admin-controlled infra.

   • [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
   • [claimed-docs] “Freedom to self-host your data”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”

   proof ↗⚑ flag

Source

1. security engineerThe client apps are open source, so the code handling my seeds can be inspected and community-reviewed

   weight 2 · round to 2FAS
   Microsoft Authenticator—none0/10

   No evidence that Microsoft Authenticator's client code is open source; it is a closed, proprietary Microsoft product with no public repository or community code review mentioned anywhere in the evidence pack.

   ⚑ flag

   2FAS✓fullprobed8/10

   2FAS explicitly markets itself as open-source and points to a public GitHub repo for code review, including for the browser extension backend ('delve deep into the intricacies'), and invites community contribution/code review. The core apps (2FAS Auth, described as 'Free, Open-source 2FA Authenticator App') are confirmed open-source via probe data. Missing for 10: no independent security audit report or third-party code-review corroboration is cited, and evidence doesn't explicitly confirm the mobile app repos (vs. just extension) are inspectable.

   • [claimed-docs] “You can easily take a look at our code - reflecting our transparent and user-first approach. Check out our GitHub repository”
   • [claimed-docs] “Join our GitHub project and contribute to 2FAS by running code review and committing your ideas.”
   • [claimed-docs] “Check out our GitHub repository and delve deep into the intricacies of the browser extension back-end.”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

Automation

1. ai-native userAn agent can fetch a current TOTP code programmatically — via CLI or API — to complete a 2FA login inside an automated workflow

   weight 2 · round drawn
   Microsoft Authenticator—none0/10

   Microsoft Authenticator is a mobile app with no documented CLI or API for programmatic TOTP retrieval; evidence even indicates its QR codes are non-standard and reject other TOTP clients, and probes confirm no API/OpenAPI surface exists. No evidence of any automation-friendly access to codes.

   • [community] “people pick MS Authenticator - it's because microsoft basically forces it on you, uses dark patterns to avoid letting you use any other stan…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://support.microsoft.com/openapi.json, https://support.microsoft.com/swagger.json, https://supp…”
   • [probe] “PROBE llms.txt: HTTP 404 at https://support.microsoft.com/llms.txt”

   proof ↗⚑ flag

   2FAS—none0/10

   The evidence explicitly states 2FAS has no public API for programmatic TOTP retrieval ('Public API: None — local-first by design, no agent-callable endpoint for token generation'), and no CLI is documented anywhere in the pack; OpenAPI probes all 404. This directly rules out agent-driven fetching of TOTP codes via CLI or API.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

2. ai-native userExpose the vault through a local programmatic endpoint an agent can query for codes and secrets without screen-scraping the app

   weight 1 · round drawn
   Microsoft Authenticator—none0/10

   No evidence of any local API, CLI, or programmatic endpoint for querying codes/secrets; probes confirm no llms.txt, docs-md, or OpenAPI endpoints exist, and the app is designed as a closed mobile experience with screen-capture disabled by default.

   • [probe] “PROBE llms.txt: HTTP 404 at https://support.microsoft.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://support.microsoft.com/en-us/authenticator/microsoft-authenticator-faqs.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://support.microsoft.com/openapi.json, https://support.microsoft.com/swagger.json, https://supp…”
   • [claimed-docs] “To see your OTP codes in screenshots or allow other apps to capture the Authenticator screen, turn on Screen Capture in Authenticator's Sett…”

   proof ↗⚑ flag

   2FAS—none0/10

   The product's own llms.txt explicitly states 'Public API: None' and no OpenAPI/local endpoint was found; 2FAS is local-first by design with no agent-callable interface for querying codes or secrets programmatically.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

Browser

1. everyday userA browser extension autofills my TOTP codes and passkeys during login instead of making me retype them

   weight 2 · round to 2FAS
   Microsoft Authenticator—none0/10

   Evidence shows Microsoft Authenticator is a mobile app generating OTP codes and offering an in-app password Autofill feature, but there is no mention of a browser extension that autofills TOTP codes or passkeys, and community evidence indicates the password autofill feature itself is being discontinued entirely (comm-11), not extended to TOTP/passkey autofill.

   • [claimed-docs] “Scroll down to the Autofill section and select Export Passwords.”
   • [claimed-docs] “Scroll down to the Autofill section and select Export Passwords... Import your passwords.”
   • [community] “Microsoft Authenticator--a mobile app that provides 2FA--is discontinuing its password autofill feature and the passwords stored/used with t…”

   proof ↗⚑ flag

   2FAS✓fullcommunity7/10

   2FAS's browser extension is documented to autofill TOTP tokens with confirmation via the mobile app ('You don't have to retype anything'), and the 2FAS Pass extension supports autofill for passwords/passkeys confirmed in the vault app, with the free tier confirmed by community reports to include auto-fill. However, evidence is vendor-documented with only partial independent corroboration and no explicit hands-on confirmation of passkey autofill specifically working smoothly in-browser. Missing for 10: independent hands-on validation of passkey autofill UX, more detail on cross-browser support, and confirmation of friction-free flow beyond vendor claims.

   • [claimed-docs] “Click the browser extension icon when you need to enter a 2FA token, then confirm in the mobile app. You don't have to retype anything.”
   • [claimed-docs] “Access through the Browser Extension or using Autofill must be confirmed in 2FAS Pass.”
   • [community] “Free tier of 2FAS Pass includes auto-fill, import/export, and standard password generator; paid tier adds multi-device sync, more than 200 v…”
   • [claimed-docs] “You can easily take a look at our code - reflecting our transparent and user-first approach. Check out our GitHub repository”

   proof ↗⚑ flag

Desktop

1. power userA first-class desktop app gives me codes and vault access on my computer, not just on mobile

   weight 2 · round drawn
   Microsoft Authenticator—none0/10

   All evidence describes Microsoft Authenticator as a mobile app (phone/wearable), with no mention of a desktop application for codes or vault access; the product is explicitly mobile-only.

   ⚑ flag

   2FAS—none0/10

   Evidence only shows mobile apps (iOS/Android) plus a browser extension, and the extension explicitly requires confirmation via the mobile app (2fas-docs-3, 2fas-docs-19) rather than functioning as an independent desktop client. No native desktop app for code generation or vault access is documented anywhere in the pack.

   • [claimed-docs] “Click the browser extension icon when you need to enter a 2FA token, then confirm in the mobile app. You don't have to retype anything.”
   • [claimed-docs] “Access through the Browser Extension or using Autofill must be confirmed in 2FAS Pass.”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

Watch

1. everyday userRead my codes from my smartwatch without pulling out my phone

   weight 1 · round to 2FAS
   Microsoft Authenticator~partialclaimed4/10

   Docs confirm Authenticator notifications can be mirrored to a wearable device, which implies some code/approval visibility without pulling out the phone, but there's no explicit confirmation that time-based OTP codes themselves are readable on a smartwatch screen, nor any hands-on/community corroboration of this specific wearable experience. missing for 10: explicit documentation that OTP codes (not just approval notifications) display on smartwatch, independent/hands-on confirmation of the wearable experience.

   • [claimed-docs] “you can mirror Authenticator notifications from your phone to your wearable device.”

   proof ↗⚑ flag

   2FAS~partialclaimed5/10

   2FAS explicitly markets 'Apple Watch — Improved convenience and accessibility' as a feature, indicating watch support exists, but there's no detail on what functionality is available on the watch (e.g., whether codes are viewable standalone or require phone proximity) and no independent/hands-on confirmation of the experience. missing for 10: details on watch app functionality/UX, confirmation codes can be read without unlocking phone, independent hands-on review of the watch experience.

   • [claimed-docs] “Apple Watch Improved convenience and accessibility.”
   • [claimed-docs] “Apple WatchImproved convenience and accessibility.”

   proof ↗⚑ flag

Backup

1. security engineerBackups are end-to-end encrypted with a key the vendor never holds, and the encryption design is documented

   weight 3 · round to 2FAS
   Microsoft Authenticator—none0/10

   Docs confirm a Cloud Backup feature exists (microsoft-authenticator-docs-9, -13) but provide no description of end-to-end encryption or a vendor-inaccessible key, and no encryption design documentation is cited anywhere. Community commentary even contrasts Microsoft's backup with an alternative app that explicitly offers 'encrypted backups' (microsoft-authenticator-comm-4), implying this property isn't established for Microsoft Authenticator.

   • [claimed-docs] “This article describes how to back up information on all the accounts you have in Authenticator so that if you lose your mobile or get a new…”
   • [claimed-docs] “Turn on the Cloud Backup toggle. Select a Microsoft personal account where the backup will be stored.”
   • [community] “Even for Microsoft accounts, use an alternative app for 2FA/MFA. Recently I switched to the open source Aegis, which allows encrypted backup…”

   proof ↗⚑ flag

   2FAS~partialcommunity4/10

   2FAS documents that backups/sync can be encrypted with a user password (docs-9, docs-17, docs-18) and that vault storage location is user-controlled, but the encryption is presented as optional ('we encourage you to do that') rather than guaranteed end-to-end by default, and there is no detailed technical whitepaper describing key derivation, zero-knowledge architecture, or threat model. Community discussion (2fas-comm-1) explicitly questions whether backups to iCloud/WebDAV truly avoid vendor/server trust, further undercutting a strong E2E claim. missing for 10: a dedicated cryptographic design document (algorithms, key derivation, zero-knowledge proof), confirmation that encryption is mandatory/default rather than opt-in, and independent security audit corroboration.

   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
   • [claimed-docs] “Multi-device sync (encrypted)”
   • [claimed-docs] “If you have enabled sync with iCloud (on iOS) or Google Drive (on Android), your encrypted 2FAS Pass Vault file is right there.”
   • [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”

   proof ↗⚑ flag

Multi device

1. everyday userMy tokens are available on my phone, tablet, and computer at the same time, kept in sync automatically

   weight 2 · round to 2FAS
   Microsoft Authenticator!disputedcontradicted4/10

   Docs describe Cloud Backup that lets you restore accounts to a new device (docs-9, docs-13), but this is backup/restore rather than true simultaneous multi-device sync across phone, tablet, and computer — there's no evidence of a tablet or desktop client. Community reports directly contradict reliability of this backup: users report Authenticator updates wiping all account data and causing lockouts (comm-1, comm-3), undermining the claim that data stays reliably available across devices. Missing for 10: evidence of simultaneous real-time sync across phone/tablet/desktop clients, and resolution of documented data-loss/backup failure reports.

   • [claimed-docs] “This article describes how to back up information on all the accounts you have in Authenticator so that if you lose your mobile or get a new…”
   • [claimed-docs] “Turn on the Cloud Backup toggle. Select a Microsoft personal account where the backup will be stored.”
   • [community] “This happened to me when I updated MS Authenticator after not updating it for a while. It wiped out all data, and I got locked out of all ac…”
   • [community] “using microsoft authenticator I just ran into this recently... it's a known issue that microsoft has no announced plan of fixing... I knew t…”

   proof ↗⚑ flag

   2FAS~partialcommunity6/10

   2FAS documents syncing tokens across devices via iCloud/Google Drive and lists 'Multi-device sync (encrypted)' as a feature, and computer access is possible through a browser extension that confirms via the mobile app. However, this cross-device access relies on manual confirmation from the phone rather than tokens being independently and automatically available on a tablet/computer at all times, and multi-device sync appears gated behind a paid tier for the Pass product. Missing for 10: evidence of true simultaneous, always-available token access across phone/tablet/computer without per-use phone confirmation, and confirmation that Auth (not just Pass) multi-device sync is free and automatic.

   • [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
   • [claimed-docs] “Click the browser extension icon when you need to enter a 2FA token, then confirm in the mobile app. You don't have to retype anything.”
   • [claimed-docs] “Multi-device sync (encrypted)”
   • [community] “Free tier of 2FAS Pass includes auto-fill, import/export, and standard password generator; paid tier adds multi-device sync, more than 200 v…”

   proof ↗⚑ flag

Recovery

1. everyday userLosing my phone doesn't lose my accounts — a documented recovery path restores my tokens on a new device

   weight 3 · round to 2FAS
   Microsoft Authenticator!disputedcontradicted5/10

   Microsoft documents a Cloud Backup feature explicitly designed to restore accounts on a new device after phone loss (docs-9, docs-13), which matches the story's claim of a documented recovery path. However, a concrete hands-on community report describes the opposite outcome — an app update wiped all backed-up data and locked the user out of every account, with the poster citing it as a known reliability issue (comm-1, comm-3) — directly contradicting the documented recovery guarantee. missing for 10: independent verification that Cloud Backup restore reliably works, resolution of the reported wipe/lockout bug, and clarity on how backup interacts with app updates.

   • [claimed-docs] “This article describes how to back up information on all the accounts you have in Authenticator so that if you lose your mobile or get a new…”
   • [claimed-docs] “Turn on the Cloud Backup toggle. Select a Microsoft personal account where the backup will be stored.”
   • [community] “This happened to me when I updated MS Authenticator after not updating it for a while. It wiped out all data, and I got locked out of all ac…”
   • [community] “using microsoft authenticator I just ran into this recently... it's a known issue that microsoft has no announced plan of fixing... I knew t…”

   proof ↗⚑ flag

   2FAS✓fullcommunity8/10

   2FAS documents multi-device sync via iCloud/Google Drive/encrypted export files for the Auth app, plus a dedicated recovery page explaining how to restore or run the Pass Vault on a new device using the cloud-synced encrypted vault file, and supports importing from other authenticator apps for migration scenarios. This directly addresses losing a phone and restoring tokens elsewhere, though community commentary raises trust questions about relying on third-party cloud storage rather than disputing that recovery works. Missing for 10: independent hands-on verification of the actual recovery flow succeeding, and clearer detail on recovery when no cloud sync was enabled beforehand.

   • [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
   • [claimed-docs] “Learn how to restore access to your 2FAS Pass Vault or run it on a different device.”
   • [claimed-docs] “If you have enabled sync with iCloud (on iOS) or Google Drive (on Android), your encrypted 2FAS Pass Vault file is right there.”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
   • [claimed-docs] “We support imports from Aegis, Raivo, LastPassAegis, Stratum (formerly Authenticator Pro) and Google Authenticator.”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”

   proof ↗⚑ flag

Automation

1. ai-native userAn agent can create and update vault entries — seeding new TOTP secrets, storing credentials — through documented programmatic surfaces

   weight 2 · round drawn
   Microsoft Authenticator—none0/10

   No evidence of any API, CLI, or programmatic surface for creating/updating vault entries or TOTP secrets; Microsoft Authenticator is a manual mobile app with QR-based account addition, and probes for API/docs endpoints returned 404s. missing for 10: any documented API/SDK/CLI for programmatic vault management, evidence of agent-accessible interfaces, confirmation of automated secret seeding.

   • [probe] “PROBE llms.txt: HTTP 404 at https://support.microsoft.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://support.microsoft.com/en-us/authenticator/microsoft-authenticator-faqs.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://support.microsoft.com/openapi.json, https://support.microsoft.com/swagger.json, https://supp…”
   • [claimed-docs] “Scan the QR code or download and install Authenticator from the Apple app store.”

   proof ↗⚑ flag

   2FAS—none0/10

   No programmatic API exists for creating/updating vault entries or seeding TOTP secrets; the product's own llms.txt explicitly states 'Public API: None' and openapi probes all 404, confirming no agent-callable surface for this workflow.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

Policy

1. it adminEnforce org-wide policies — require app lock, restrict export, mandate strong master credentials — across every member's app

   weight 1 · round drawn
   Microsoft Authenticator—none0/10

   Evidence only hints that notifications may be gated 'if allowed by your administrator' and that location-sharing is required for conditional access, but there is no documentation of an admin console or policy set that lets IT enforce app lock, restrict export, or mandate strong master credentials across all org members. Community evidence even suggests admins lack granular control tools (comm-6), reinforcing the absence of such enterprise policy enforcement in this pack.

   • [claimed-docs] “You can set up notifications for your work or school account (if allowed by your administrator) or for your personal Microsoft account.”
   • [claimed-docs] “When App Lock is enabled, you'll be asked to authenticate using your device PIN or biometric every time you open Authenticator.”
   • [claimed-docs] “You'll need to share your location once every hour to ensure you're still within a country where you are allowed to access the resource.”
   • [community] “people pick MS Authenticator - it's because microsoft basically forces it on you, uses dark patterns to avoid letting you use any other stan…”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS is a consumer-focused authenticator/password manager with no evidence of centralized org policy management, admin dashboards, enforced app-lock policies, export restrictions, or credential strength mandates across users; it is explicitly local-first with no public API for such control (2fas-probe-rt-1). No IT-admin console or MDM/policy feature is documented anywhere in the pack.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [claimed-docs] “Freedom to self-host your data”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”

   proof ↗⚑ flag

Sharing

1. it adminMy team can share TOTP-protected logins through shared vaults or collections with per-member access control

   weight 2 · round drawn
   Microsoft Authenticator—none0/10

   Microsoft Authenticator is a personal/individual authenticator app with no evidence of shared vaults, collections, or per-member access control for teams; its passwords feature is even being discontinued. Missing for 10: shared vault/collection feature, per-member access control, admin sharing management console.

   • [community] “Microsoft Authenticator--a mobile app that provides 2FA--is discontinuing its password autofill feature and the passwords stored/used with t…”
   • [claimed-docs] “This article describes how to back up information on all the accounts you have in Authenticator so that if you lose your mobile or get a new…”
   • [claimed-docs] “Turn on the Cloud Backup toggle. Select a Microsoft personal account where the backup will be stored.”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS is positioned as a personal, local-first authenticator/password manager with individual sync (iCloud/Google Drive/self-host) and multi-device sync for a single user, not team/organization features. No evidence of shared vaults, collections, or per-member access control for an IT-admin-managed team; the HN community discussion even questions its single-user 'local-only' security model, but nothing addresses team sharing at all.

   • [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
   • [claimed-docs] “Multi-device sync (encrypted)”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”
   • [community] “Free tier of 2FAS Pass includes auto-fill, import/export, and standard password generator; paid tier adds multi-device sync, more than 200 v…”

   proof ↗⚑ flag

Enrollment

1. everyday userScan a QR code and immediately start generating TOTP codes for a new account

   weight 3 · round to 2FAS
   Microsoft Authenticator!disputedcontradicted5/10

   Microsoft's own docs confirm the app supports one-time-password codes for two-step verification (docs-12), implying QR-based account setup generates TOTP codes offline. However, hands-on community reports describe a known QR-scan bug that forces users to cancel the dialog and add accounts manually without the QR code (comm-3), and another user notes the QR codes Microsoft issues for its own accounts are non-standard and rejected by other TOTP clients (comm-6), directly contradicting a smooth 'scan and immediately generate' experience. missing for 10: no first-party doc walking through the exact 'add account via QR scan' flow, and no resolution/acknowledgment of the reported scan failures.

   • [claimed-docs] “As a way to sign in every time, by using a one-time password code to increase account security. This is called two-step verification or mult…”
   • [community] “using microsoft authenticator I just ran into this recently... it's a known issue that microsoft has no announced plan of fixing... I knew t…”
   • [community] “people pick MS Authenticator - it's because microsoft basically forces it on you, uses dark patterns to avoid letting you use any other stan…”

   proof ↗⚑ flag

   2FAS~partialprobed5/10

   2FAS Auth is a well-known TOTP app and docs reference connecting accounts via video tutorials, but the evidence pack lacks any direct documentation or hands-on confirmation of the core QR-scan-to-code-generation flow. missing for 10: explicit documentation/screenshots of QR scanning UX, confirmation that codes generate immediately post-scan, independent/hands-on corroboration of the onboarding flow.

   • [claimed-docs] “use our quick and easy-to-follow video tutorials to connect your online accounts.”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

Offline

1. power userCodes generate fully offline — no network, no vendor account required just to see my TOTP codes

   weight 2 · round to 2FAS
   Microsoft Authenticator!disputedcontradicted4/10

   Microsoft's own docs claim codes work without an internet connection or phone service (microsoft-authenticator-docs-2), but hands-on community reports contradict this for real-world enterprise use: one user reports 'ms authenticator doesn't generate a code until I first log into the vpn using exchange creds' (microsoft-authenticator-comm-10), and another notes the app issues non-standard QR codes that lock users into the vendor's app rather than plain TOTP (microsoft-authenticator-comm-6), undermining the 'no vendor account required' and pure-offline claims for many real deployments. Missing for 10: independent technical verification of offline TOTP generation across account types, and confirmation that no Microsoft account/login is ever required to view codes.

   • [claimed-docs] “The codes don't require you to be on the internet or connected to data, so you don't need phone service to sign in.”
   • [community] “it seems to be a push notification where the ms authenticator doesn't generate a code until I first log into the vpn using exchange creds.”
   • [community] “people pick MS Authenticator - it's because microsoft basically forces it on you, uses dark patterns to avoid letting you use any other stan…”
   • [community] “My company used to allow TOTP so many TOTP apps could be used instead of Microsoft Authenticator but my company disabled that a while ago. N…”

   proof ↗⚑ flag

   2FAS✓fullprobed8/10

   2FAS Auth is described as open-source, local-first with no public API for token generation, and pricing docs confirm it's free with no telemetry, consistent with fully offline TOTP generation without vendor account requirement. Community evidence questions cloud-sync/backup security but this concerns 2FAS Pass (password manager), not the core Auth TOTP generation flow. missing for 10: independent hands-on confirmation that TOTP codes generate with device fully offline (airplane mode test), and explicit documentation stating no account/signup is ever required.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE runtime (recorded 2026-09-15): machine-readable pricing verified live at https://2fas.com/.well-known/pricing.md — '# 2FAS Pricing... …”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”

   proof ↗⚑ flag

Organization

1. power userKeep dozens of tokens organized — search, folders or groups, and service icons — so the right code is always two taps away

   weight 2 · round to 2FAS
   Microsoft Authenticator—none0/10

   No evidence describes organizational features like search, folders/groups, or per-account service icons for managing many tokens; docs cover backup, passwordless sign-in, and notifications but not organization/search UX. Community evidence even suggests account list issues (duplicate/overwrite concerns) rather than robust organization tools. Missing for full credit: any mention of search, folder/grouping, or icon-based organization of accounts.

   • [claimed-docs] “This article describes how to back up information on all the accounts you have in Authenticator so that if you lose your mobile or get a new…”
   • [community] “I have many accounts with the same user names, and they don't get overwritten. There might be some design flaw somewhere, but it's surely no…”

   proof ↗⚑ flag

   2FAS~partialclaimed6/10

   Docs confirm token customization with 'full control over groups, badges, icons, and labels' and Apple Watch access, directly supporting organization by groups/icons for quick access, but there is no mention of search functionality within the token list, no detail on folder/group UX depth, and no independent hands-on account of managing 'dozens of tokens' at scale. missing for 10: explicit search feature evidence, hands-on/independent validation of organization UX at scale, deeper detail on folder vs group implementation.

   • [claimed-docs] “Token customization Full control over the groups, badges, icons, and labels.”
   • [claimed-docs] “Token customizationFull control over the groups, badges, icons, and labels.”
   • [claimed-docs] “Apple Watch Improved convenience and accessibility.”
   • [claimed-docs] “Apple WatchImproved convenience and accessibility.”

   proof ↗⚑ flag

Variants

1. power userNon-standard tokens work too — Steam Guard, HOTP counters, custom periods and digit lengths

   weight 2 · round drawn
   Microsoft Authenticator—none0/10

   No evidence anywhere in the pack indicates Microsoft Authenticator supports HOTP counters, Steam Guard, or custom period/digit-length TOTP tokens; docs only describe standard push/OTP sign-in flows. Community evidence even suggests the opposite — its QR codes are non-standard TOTP and rejected by other clients, implying inflexibility rather than support for non-standard token types.

   • [claimed-docs] “As a way to sign in every time, by using a one-time password code to increase account security. This is called two-step verification or mult…”
   • [community] “people pick MS Authenticator - it's because microsoft basically forces it on you, uses dark patterns to avoid letting you use any other stan…”

   proof ↗⚑ flag

   2FAS—none0/10

   No evidence in the pack addresses Steam Guard tokens, HOTP counter-based codes, or custom period/digit-length configuration for 2FAS Auth — the docs only mention generic 'token customization' for groups/badges/icons/labels, which is unrelated to non-standard token algorithms.

   • [claimed-docs] “Token customization Full control over the groups, badges, icons, and labels.”
   • [claimed-docs] “Token customizationFull control over the groups, badges, icons, and labels.”

   proof ↗⚑ flag