--- title: Bitwarden Authenticator canonical: https://saasranked.com/software/bitwarden-authenticator/ category: Authenticator Apps points: 54 rank: 6 of 12 facts_checked: 2026-10-08 --- # Bitwarden Authenticator Free open-source iOS and Android app for two-factor codes that works without a Bitwarden account. 54 points out of 100. #6 of 12 authenticator apps. Vendor: Bitwarden, Inc.. Website: https://bitwarden.com/products/authenticator/ - The app is free on iOS and Android and works without a Bitwarden account [1][2]. - Backup relies on the phone's cloud backup, such as iCloud Backup or Google One; codes are not synced to Bitwarden servers [2]. - Unit 42 (2025) and Mandiant (2024) audited the Bitwarden mobile apps and the mobile Authenticator app; reports are published [5]. - Source code is public under GPL-3.0 on GitHub [6][7]. - Import accepts Google Authenticator, 2FAS, Aegis and LastPass; export gives JSON or CSV [3]. Verdict: Bitwarden Authenticator suits phone users who want a free app from a vendor that publishes mobile audit reports [1][5]. It needs no account and imports from several other apps [2][3]. The catch: backup depends on the phone's own cloud backup, there is no desktop app, and its bug bounty is private [2][5]. Best for: Phone users who want a free, audited, open-source code app with no sign-up. ## Points | Criterion | Line | Value | Points | Note | |---|---|---|---|---| | Security and trust | End-to-end encrypted backup | Not published | 0/12 | Not published; the help page names device cloud backup and describes no key only you hold [2]. | | Security and trust | Independent audit, 2023 or later | Yes | 10/10 | Unit 42 (2025) and Mandiant (2024) audited the mobile authenticator apps; reports are linked [5]. | | Security and trust | Open-source apps | Yes | 6/6 | Android and iOS repositories carry the Authenticator app under GPL-3.0 [1][6][7]. | | Security and trust | Public bug bounty | No | 0/3 | Bitwarden describes its HackerOne bug bounty as private [5]. | | Security and trust | App lock | Yes | 6/6 | Help page says you can set up biometric login to protect the app [2]. | | Backup and recovery | Cloud backup or sync | Yes | 10/10 | Data is backed up by the device's cloud backup, for example iCloud Backup or Google One. Counted as cloud backup [2]. | | Backup and recovery | Same codes on several devices | Not published | 0/7 | Not published; the help page covers only moving codes to a new device [2][4]. | | Backup and recovery | Export all accounts | Yes | 7/7 | Local Authenticator data exports as JSON or CSV [3]. | | Backup and recovery | Import from other apps | Yes | 6/6 | Imports from Google Authenticator, LastPass, 2FAS, Aegis, Raivo and Bitwarden exports [3]. | | Backup and recovery | Works without an account | Yes | 5/5 | Available with or without a Bitwarden Password Manager account [2]. | | Systems | Apps | iOS, Android | 4/12 | Help page says it is available on iOS and Android; mobile only [1][2]. | | Features | Stores passkeys | Not published | 0/3 | Not published on the Authenticator product or help pages [1][2]. | | Features | Sign-in approval prompts | Not published | 0/3 | Not published on the Authenticator product or help pages [1][2]. | | Features | Counter-based (HOTP) codes | Not published | 0/3 | Not published; the pages describe only time-based codes [1][2]. | | Features | Folders, tags or search | Not published | 0/3 | Not published; the help page mentions only marking favourites, not folders, tags or search [2]. | | Price | Cost with backup on two devices | Not published | 0/4 | Free, but no page documents the same codes on two devices, so the condition is not met [2][4]. | ## Plans | Plan | Price | Per month (USD) | |---|---|---| | Free | Free [1] | $0 | ## Strengths - Free, and usable without a Bitwarden account [1][2]. - Two outside audits of the authenticator apps, 2024 and 2025, with published reports [5]. - Source code is public under GPL-3.0 [6][7]. - Imports from Google Authenticator, 2FAS, Aegis, LastPass and Raivo [3]. ## Limits - Mobile only: iOS and Android, no desktop app [2]. - Backup is left to the device's cloud backup; the page does not describe a key only you hold [2]. - Bitwarden calls its HackerOne bug bounty private [5]. - Local codes sit in an unencrypted local database on the device [2]. ## Sources 1. [Bitwarden Authenticator](https://bitwarden.com/products/authenticator/), Bitwarden, accessed 2026-10-08 2. [Bitwarden Authenticator help](https://bitwarden.com/help/bitwarden-authenticator/), Bitwarden, accessed 2026-10-08 3. [Import and export Authenticator data](https://bitwarden.com/help/authenticator-import-export/), Bitwarden, accessed 2026-10-08 4. [Sync verification codes](https://bitwarden.com/help/totp-sync/), Bitwarden, accessed 2026-10-08 5. [Is Bitwarden audited?](https://bitwarden.com/help/is-bitwarden-audited/), Bitwarden, accessed 2026-10-08 6. [bitwarden/android](https://github.com/bitwarden/android), GitHub, accessed 2026-10-08 7. [bitwarden/ios](https://github.com/bitwarden/ios), GitHub, accessed 2026-10-08