How to Set Up Authy for Two-Factor Authentication (2FA)?
Introduction
Authy is a free two-factor authentication (2FA) app from Twilio that generates six-digit, time-based codes on your phone. You add an account by scanning its QR code, then enter the current code whenever you log in. Your Authy account is registered to your phone number, so protecting that number matters as much as protecting the app.
This guide covers how to set up Authy, how backups and multiple devices work, what changed with Authy since 2024, and how it compares with Google Authenticator.
Authy at a glance
- Cost: free for users
- Platforms: iOS and Android phones and tablets. Twilio ended the Windows, macOS and Linux desktop apps on March 19, 2024.
- Codes: time-based one-time passwords (TOTP), generated on your device without an internet connection
- Backups: optional, encrypted with a backups password that Twilio cannot recover
- Account: registered to your phone number
Is your cellphone vulnerable to SIM Swap? Get a FREE scan now!
Please ensure your number is in the correct format.
Valid for US numbers only!
How Does Authy Work?
Authy uses the time-based one-time password (TOTP) standard. When you turn on 2FA for an account, the website gives you a secret key, usually shown as a QR code. Authy stores that key and combines it with the current time to create a new six-digit code, usually every 30 seconds. The website does the same calculation on its side, so the codes match.
Because codes are calculated on your device, Authy works without an internet connection. It also works with any site that supports authenticator apps, the same standard used by Google Authenticator and Microsoft Authenticator.
How to Set Up Authy (Step by Step)
Step 1: Install Authy
Download Twilio Authy from the Apple App Store or Google Play.
Step 2: Register with your phone number
Open the app, enter your phone number and email address, and confirm with the verification code Authy sends to your phone.
Step 3: Turn on 2FA for the account you want to protect
Log in to the account (for example Google, Microsoft or a crypto exchange), open its security settings and choose two-factor authentication with an authenticator app.
Step 4: Scan the QR code
In Authy, tap the + button to add an account and scan the QR code on the screen. If you cannot scan it, enter the setup key the website shows instead.
Step 5: Confirm with your first code
Type the six-digit code Authy shows into the website to finish setup. Save the backup or recovery codes the website gives you somewhere safe, because they are your way back in if you lose access to Authy.
Step 6: Lock the app
Turn on the Protection PIN or biometric lock in Authy's settings so nobody can open your codes on an unlocked phone.
How to Back Up Your Authy Codes
By default, Authy stores your tokens only on your device. Twilio warns that if that device is lost or fails, you could permanently lose your 2FA tokens. Turning on Backups saves an encrypted copy of every token to your Authy account.
- Open Authy and go to Settings.
- Open the Accounts tab and turn on Authenticator Backups.
- Create a strong backup password and store it in a password manager.
Your backups password encrypts your tokens before they leave your phone and is never sent to Authy. That keeps your backups private, but it also means Twilio cannot recover a forgotten backups password. Account recovery does not reset it either.
How to Use Authy on Multiple Devices
The Multi-Device setting links trusted devices, such as a phone and a tablet, to one Authy account and keeps your tokens in sync.
- On a device that already has Authy, go to Settings, then Devices, and turn on Allow multi-device.
- Install Authy on the new device and register with the same phone number.
- Approve the new device from your existing device or by SMS.
- Go back to Settings, then Devices, and turn Allow multi-device off again.
With Multi-Device turned off, your existing devices keep syncing, but nobody can add a new device to your account until you switch it back on. You can only change this setting from a working device that is already on your account.
SIM Swap Protection
Get our SAFE plan for guaranteed SIM swap protection.
How to Move Authy to a New Phone
Before you switch phones, check that both Multi-Device and Backups are turned on and that you know your backups password. Then install Authy on the new phone, register with your number, approve the new device, and remove the old phone from Settings, then Devices.
If you have lost your only device and Multi-Device was off, you need account recovery at authy.com/phones/reset. Twilio says this takes 24 hours and cannot be rushed. If Backups were off, or you no longer know the backups password, your tokens cannot be restored and you will need each website's recovery codes.
What Changed With Authy Since 2024
The desktop apps were discontinued
Twilio ended the Authy desktop apps for Windows, macOS and Linux on March 19, 2024, earlier than the August 2024 date it first announced. If you used Authy on a computer, use a phone or tablet instead.
Phone numbers linked to Authy accounts were exposed
On July 1, 2024, Twilio reported that attackers had used an unauthenticated endpoint to identify data associated with Authy accounts. About 33 million phone numbers were reported exposed. Twilio asked users to update to the latest app (Android 25.1.0 or later, iOS 26.1.0 or later) and to watch for phishing and scam texts using those numbers.
What to do: keep Authy updated, never share a code with anyone who calls or texts you, and treat unexpected messages about your Authy account as phishing.
Monthly
Yearly
Why Your Phone Number Is the Weak Point
Authy generates codes on your device, but your Authy account is registered to your phone number, and a new device can be approved by SMS. If someone moves your number to their own SIM card through a SIM swap, those texts go to them. The same risk applies to every account that still lets you log in or reset a password with an SMS code.
To close that gap:
- Keep Multi-Device turned off unless you are adding a device.
- Use a long, unique backups password, so a new device cannot read your backups without it.
- Ask your carrier for a PIN and a port-out lock on your number.
- Remove SMS as a 2FA or recovery option on accounts that offer an authenticator app or security key.
Read more about how SIM swaps get around 2FA and how port-out locks help. Efani is a mobile service built to protect your number against SIM swaps. See how it works.
How Secure Is Authy?
Strengths:
- Codes are generated offline on your device and usually change every 30 seconds.
- A PIN or biometric lock protects the app on your phone.
- Backups are encrypted with a password only you know.
- You can block new devices by turning Multi-Device off.
Limits:
- Your account is tied to your phone number, which can be targeted through SIM swaps and scam texts.
- Your backups are only as strong as your backups password.
- Like any code-based 2FA, a fake login page can trick you into typing a code. For your most valuable accounts, a hardware security key (FIDO2 / passkey) gives stronger protection against phishing.
Authy vs Google Authenticator
For a full walkthrough of the alternative, see our guide to using Google Authenticator for 2FA.
Best Practices for Using Authy Safely
- Turn on Backups and keep your backups password in a password manager.
- Keep Multi-Device off except when you are adding a device.
- Lock the app with a PIN or biometrics, and lock your phone with a strong passcode.
- Save each website's recovery codes offline, separate from your phone.
- Keep Authy updated to get security fixes.
- Protect your phone number with a carrier PIN, a port-out lock, or a SIM swap protected mobile service.
Authy FAQs
Is Authy free?
Yes. Twilio says the Authy app is free for end users because businesses that use Twilio's authentication services pay for it.
Can I use Authy on a computer?
Not with an official desktop app. Twilio ended the Authy desktop apps for Windows, macOS and Linux on March 19, 2024. Use Authy on your phone or tablet instead.
What happens if I lose my phone?
If you have another device linked to your Authy account, use it to remove the lost phone and add your new one. If you have no other device, start account recovery at authy.com/phones/reset. Recovery takes 24 hours and cannot be rushed, and you can only restore your codes if Backups were on and you know your backups password.
Can Twilio recover my Authy backups password?
No. Your backups password is never sent to Authy, so Twilio cannot recover or reset it. Store it in a password manager.
Is Authy safe to use after the 2024 incident?
In July 2024 Twilio reported that attackers used an unauthenticated endpoint to identify data linked to Authy accounts, with about 33 million phone numbers reported exposed. Twilio asked users to update the app and watch for phishing and scam texts. Keep the app updated, never share your codes, and treat unexpected messages about your Authy account as suspicious.
Can I use Authy without backups?
Yes. Backups are optional, and without them your tokens are stored only on your device. Twilio warns that if that device is lost or fails, you could permanently lose your 2FA tokens, so only skip backups if you have another linked device and have saved each website's recovery codes.
How do I remove an account from Authy?
First turn off 2FA for that account on the website itself, or switch it to another 2FA method. If you delete the token from Authy while 2FA is still on, you can lock yourself out. Then remove the account from the account list in Authy's settings.
Does Authy protect me from SIM swapping?
Not on its own. Authy generates codes on your device, but your Authy account is registered to your phone number, and new devices can be approved by SMS. Keep Multi-Device off when you are not adding a device, use a strong backup password, and protect the number itself with your carrier.
Conclusion
Authy is a free, easy way to add app-based 2FA to your accounts, and its encrypted backups and multi-device support make switching phones simpler. Set it up with Backups on, Multi-Device off and a strong backup password. Then protect the one thing your Authy account depends on: your phone number. Learn how Efani protects your number from SIM swaps.
