Learn

What app “cloud sync” really does to your 2FA secrets

Google Authenticator, Microsoft Authenticator and Authy all advertise easier lives — but “your codes everywhere” means copies of your secrets live somewhere. Here’s where, for each of them, and how to set up the same convenience without the unknown.

The sync trade-off, stated plainly

A TOTP secret is just a small string (our guide to the math shows what it encodes). Any app that displays codes must hold that string — the interesting question is where, and who else can get it:

Offline app, no backup (classic Google Authenticator): a copy on one phone and a copy on each enrolled service’s servers. Lose the phone, lose the convenience of codes — the service-side copy is what forces recovery-at-a-distance.
Vendor cloud sync (Authy, modern Google/Microsoft apps): an encrypted-at-rest copy sits in the vendor’s cloud, bound to an account the vendor controls. You gain instant multi-device recovery; you accept that the vendor’s account security (and their breach history) now applies to all your secrets at once.
Password-manager vault + live generation: secrets ride the vault’s end-to-end encryption; an authenticator surface anywhere can mint codes offline. Strongest ownership story — with the fixed cost that “I lost the vault I control” is exactly as bad as designed, which is why vault recovery discipline matters.

None of these are wrong. They solve different failure modes — be honest about which failure would hurt you most.

Google Authenticator

Google’s classic was proudly offline. In 2023 it gained optional cloud backup: enable it, and your secrets upload to your Google account, so sign-ins produce codes on any signed-in device. Google’s documentation has described the transfer as encrypted in transit and at rest but not end-to-end encrypted — in practical terms, a compromise of your Google account can expose the backup, and Google itself sits on that trust chain. If you use it: guard your Google account hard (passkey first — see TOTP vs passkeys), check the “Export accounts” / export-QR path that exists on-device, and treat backup-on as a deliberate choice per account value.

Microsoft Authenticator

Microsoft Authenticator’s story is cloud-forward from the start: personal-account backups go into your Microsoft account (bound to that account's own 2FA), and Microsoft also pushes the app as a sign-in factor with number-matching push approvals. That per-approval model is genuinely good against blind phishing, but the backup copies of your TOTP secrets ride on the Microsoft account; the same theme as Google, with Microsoft in the trust chain.

Authy

Authy popularized multi-device TOTP: encrypted-at-rest backups in Twilio’s cloud, device-pairing approvals, and (historically) a desktop app. Two events shaped the current picture and are worth knowing when you rely on it: in mid-2024, Twilio reported that an unsecured endpoint let attackers identify certain Authy users’ phone numbers (they used it for SIM-swap targeting; Authy’s own end-to-end design means secrets weren’t extracted), and the same summer Twilio ended support for the desktop apps, making it phone-first today. As of our last review, Authy remains encrypted-backup cloud-first — convenient, with the same “trust the vendor’s account security” shape as above.

How to choose — threat model first

Rank the failures you actually fear:

“I lose the phone and can’t log in for a week.” Cloud sync wins; any of the big three will have you back in minutes. Use it widely.
“Someone monetizes my email + every synced copy at once.” Vendor cloud is the weakest point in this sentence. For exchange, banking, primary email and work accounts, prefer secrets living only in an end-to-end-encrypted vault — yours.
“A vendor quietly changes behavior (drops a platform, gets breached).”Any vendor-bound setup can. The antidote is the same: keep the Base32 secrets portable, so you re-point generation to the next tool in minutes — app, browser, or this site’s offline generator.

A practical split: cloud-synced app for everyday social and shopping accounts; vault-held secrets for the accounts that hurt when lost; recovery codes for everything, saved the same day. And remember that sync-in-anything still leaves one hard rule: when you enroll a new key, the generator at the top of our homepage will confirm the mechanism the same way any app would — the codes must match at sign-in time, wherever you keep the secret.

The local-first alternative

If “no vendor in my secrets path” sounds like the boring end-state you want: keep a Base32 secret in your encrypted password-manager vault per service, and produce codes on demand in a browser that computes them locally (Web Crypto, no network — page works even disconnected). That is exactly how 2facounter.com works, and why the privacy policy can truthfully say nothing is uploaded. The trade-offs are spelled out in the home FAQ: browser profile storage is a convenience cache (treat the profile like a vault), and the master copy is whatever you keep in the password manager.

FAQ

Is Google Authenticator’s backup end-to-end encrypted?

No — and Google says so plainly in its own documentation. Cloud backup in Authenticator has historically been encrypted in transit and at rest on Google’s servers without being end-to-end encrypted, meaning that protecting that copy is Google’s job, while the copy of your Google account itself (its own 2FA and any attacker who breaches it) carries the blast. Treat the cloud copy as a convenience tier, not a right you can rotate.

Is it safe to use an app with cloud sync at all?

It’s a trade-off, not a trap. Cloud sync hugely reduces the most common 2FA catastrophe — losing the only device — and for most people most of the time, it beats having no 2FA because the phone drowned in a lake. The honest move is matching the security tier to the account tier: cloud-synced apps everywhere it’s convenient, but keep the secrets of your highest-value accounts in your own encrypted vault, where cloud sync means your password manager’s E2E design rather than an app vendor’s.

Can I move keys out of one authenticator app into another?

Almost always, yes. Re-enroll per service: open each account’s 2FA settings, remove the old authenticator method, and add a new one — services issue a fresh setup key in the flow. You don’t need the old secret to migrate; you need live access to each account, which is exactly why you should do migrations calmly, with recovery codes saved, rather than mid-emergency.

What’s the most private way to run TOTP codes today?

Keep the secret (the Base32 key) in an encrypted password-manager vault and generate codes live in a browser — a local tool like this site does it with zero network. Your "sync" then becomes the password manager’s own end-to-end design, the secrets are yours to export in plain text, and nothing app-specific can silently upload them somewhere you haven’t thought through.