16 rules in 5 groups, worth 100 points in all. They were set before any product was scored and apply the same way to all 12.
Version 1, published 8 Oct 2026
In short
Each rule is a yes-or-no fact, a list (such as the systems with an app) or a number with published thresholds, read from the vendor's own pages.
A fact the vendor does not publish earns nothing. A feature in beta or preview does not count.
The list follows the points. A tie goes to the lower price on "cost with backup on two devices", then to the name.
Standalone two-factor code apps for individuals, free or paid. Most run on a phone, so a Windows app is scored, not required. Password managers, hardware keys and business single sign-on tools are left out. "On at least one plan" counts only plans for individuals. Vendor help pages and public source repositories count as documentation.
Security and trust 37 points
Rule
What it takes
Points
End-to-end encrypted backup
The vendor documents that backed-up or synced codes are encrypted with a key only you hold (for example from your password or passphrase), so the vendor cannot read them. A page that only says data is encrypted in transit and at rest does not count. An app with no backup records false.
12
Independent audit, 2023 or later
A named outside firm audited or penetration-tested the app, and the vendor publishes the report or a summary dated 2023 or later.
10
Open-source apps
The source code of the apps is public under an open-source licence.
6
Public bug bounty
A public bug bounty programme that covers the app, run by the vendor or on a platform such as HackerOne or Bugcrowd.
3
App lock
The vendor documents a lock that must be opened with biometrics, a PIN or a passcode before codes are shown.
6
Backup and recovery 35 points
Rule
What it takes
Points
Cloud backup or sync
Codes can be backed up or synced to the vendor's cloud, or to a cloud storage account such as Google Drive or iCloud that the app connects to, so a lost phone does not lose them, on at least one plan. A backup file saved only to a local folder or by manual export does not count.
10
Same codes on several devices
The vendor documents that one set of codes can be used on two or more devices at the same time.
7
Export all accounts
A documented way to export all accounts at once to a file or a transfer code, so you can move to another app.
7
Import from other apps
A documented way to bring in accounts from another authenticator app, by file or migration code.
6
Works without an account
You can add accounts and get codes with no sign-up, email address or phone number given to the vendor.
5
Systems 12 points
Rule
What it takes
Points
Apps
Windows, macOS, Linux, iOS and Android each need an official native app (a store app or installer). Web needs an official web app that shows your codes. A web app or browser extension does not count for the other five. Each one earns 2 points.
12
Features 12 points
Rule
What it takes
Points
Stores passkeys
The vendor documents that the app creates and stores passkeys for any website or service that supports them, not only for the vendor's own accounts, and says this is generally available.
3
Sign-in approval prompts
The app can approve a sign-in with a push notification or number match, for at least one kind of account.
3
Counter-based (HOTP) codes
The vendor documents support for counter-based HOTP codes as well as time-based codes.
3
Folders, tags or search
You can sort accounts into folders, groups or tags, or search them by name, as documented by the vendor.
3
Price 4 points
Rule
What it takes
Points
Cost with backup on two devices
The cheapest way for one person to get backup of all codes (as in the cloud backup line) and the same codes on two devices, in US dollars a month, billed yearly, at the regular price. A free app counts as $0. If the app cannot do both, or no price is published, record null. $0 earns 4 points, $1 or less 3, $2 or less 2, $4 or less 1.