A practical option for people who want control of their authenticator data. Set up recovery before relying on a single phone.
- Encrypted vault with optional biometric unlock
- Import, export and automatic backup options
- A lost vault password can block recovery
- Moving tokens needs a separate check for each service
The vault is one part of access
Aegis stores supported authentication tokens in an Android vault. The project documents encryption, optional biometric unlocking, imports, exports and automatic backups. These features help manage the codes, but each website or service still controls its own enrollment and recovery process. Installing an authenticator does not automatically turn on two-step verification for accounts you already use.
Migrate one account at a time
Our suggested approach is to start with a low-risk service whose recovery options you understand. Keep your existing method available, follow the service’s setup instructions and test a fresh sign-in before removing the old method. Store the service’s recovery codes separately from the phone. Do not paste a setup secret into a message or screenshot collection simply to remember it later.
Prove that a backup is usable
Choose an encrypted export or backup workflow and keep the vault password somewhere you can recover independently. Check the destination and date after making a backup; the presence of a setting is weaker evidence than an actual file. Before deleting an old device, follow the project’s restore instructions and verify access on the replacement. This article describes documented options, not a security audit or a guarantee that every service supports the same token format.
Go straight to the people who make it.
Aegis official features and downloadsSource check: 2026-09-29. This is a research review based on official documentation. We have not performed hands-on tests for this review.