The 2 Best Two-Factor Authentication Apps of 2025
Duo Mobile is a straightforward 2FA authenticator app from Cisco, a major industry name. The app makes it easy to enroll sites with 2FA and to find those codes when you need to enter them. We especially like how it handles secure backups, and this is what sets it apart from the competition.
It has an easy-to-use interface that’s also easy on the eyes. You might not spend a lot of time in your 2FA authenticator app, but the time you do spend there shouldn’t be a headache. We like Duo Mobile’s spacious, uncluttered interface, which is punctuated with tasteful pops of color.
Each site you enroll with Duo Mobile appears as a card in the app, with the name of the site and (in some cases) a logo. Each entry is collapsed, and it reveals the code only when you tap on it. A decaying blue line and countdown provide a visual indication for how much longer the code is valid. If you want to move, rename, or delete an entry, just tap the three-button menu.
It’s easy to enroll new sites. Duo Mobile walks you through a quick tutorial the first time you add a new site. We especially liked that it explicitly instructs you to enter the generated code back into the site you’re enrolling—a step that’s easy to miss, especially if you’re new to 2FA authenticator apps.
The Add Account button is clearly marked in the app, and from there you can quickly scan a QR code to input a new site. You’re also presented with a lengthy list of sites that support 2FA, though this is less helpful than it sounds. Tap any one, and you have to manually enter an alphanumeric key to begin generating TOTP codes, instead of scanning a QR code. Duo Mobile could retool this list to be a more-accessible onramp.
It has optional, encrypted backups. With just a toggle and a password, Duo Mobile will back up all of your accounts protected with 2FA. So if you get a new phone, lose your old phone, or delete the Duo Mobile app, you can pick up right where you left off. And, unlike most other 2FA apps, Duo Mobile doesn’t ask you to provide any personal information or create an account to securely back up your accounts. Your backup is stored in your iCloud for iPhones and Google Drive for Android devices, so Duo Mobile never has access to your backup or the means to decrypt it. It also can’t restore your backup for you if you lose or forget your password, so be sure to write it down.
You’ll need to supply a strong password, and Duo Mobile will reject weak choices like “1234567890.” To secure this backup, we recommend using some of the techniques for creating a memorable master password for a password manager and storing that password someplace safe. On an iPhone, Duo is capable of securely recovering your data without your needing to enter the password in some circumstances, but you should hold on to it just in case.
Although it’s exceptionally unlikely, an attacker could steal backups and attempt to decrypt their contents. We think the benefits of Duo Mobile’s encrypted backups outweigh that small risk. But they’re optional, if you don’t feel the same.
We found that easy, encrypted backups were the defining feature of the best 2FA authenticators we reviewed. And we think Duo Mobile’s backup mechanism is the best, even if you can’t use the backup mechanism to move from an old iPhone to a new Android phone (or vice versa). We didn’t like that Authy required a phone number to back up its accounts, and we weren’t comfortable with how Google Authenticator could potentially access user backups.
Flaws but not dealbreakers
Duo Mobile needs a design overhaul to stay relevant. Many other apps we tested included creature comforts such as dark and light modes as well as smart innovations like folders and favoriting to keep lists organized. Duo also still lacks useful security features like the ability to lock the app with a PIN, facial recognition, or a fingerprint sensor.
The app is currently designed for businesses, not everyday people. Labeling sites as “third party” makes sense for corporate customers who need to sort them from the sites they use for work, but for everyone else it’s just confusing. Duo offers useful resources, but you have to read carefully to sort out what applies to consumers and what doesn’t.
Duo Mobile is not as transparent about its practices as we’d like. When we asked to see any third-party audits, we were told that those audits were under non-disclosure agreements, and we were directed to a list of standards with which the company complies. We’d like the company to engage in audits that can be released publicly. Google Authenticator, for example, participates in the Mobile Application Security Assessment program, which involves a publicly released third-party audit of basic security practices (PDF).
While performing a review of several authenticator apps and their backup mechanisms, University of California Berkeley researchers found that Duo Mobile encrypted backup data using secure, modern methods. Duo Mobile confirmed to us in 2024 that it uses Argon2, PBKDF2, and XSalsa20 stream cipher to encrypt backup data. We appreciate this candor, but the company should make this information available on its website.
You can’t easily move between Android and iPhone. Duo Mobile’s backups are restricted to the kind of device they’re created on. Google Authenticator included a convenient option to export authentication information between devices using a QR code, and it would be nice to see Duo Mobile do something similar.
link
