Aegis Authenticator

Aegis is an open-source authenticator app by Beem Development: it generates the login codes that websites ask for after your password when two-factor login is on. It keeps them in an encrypted vault on the phone and doesn’t request internet access at all, so there is no account, no sync and no cloud copy unless you make one yourself.

Moving from Google Authenticator? See our step-by-step guide: How to move your Google Authenticator codes to Aegis.

The vault

• Encryption. With a password set, the vault is encrypted with AES-256 in GCM mode, using a key derived from your password with scrypt; the developers chose “the same parameters as Android itself uses to derive a key for full-disk encryption”. Biometric unlock adds a second key stored in the Android Keystore. Their design notes add that the vault’s master key “is only as secure as the weakest credential”.
• No password is possible too, but Aegis says “This option is not recommended”: the vault is then stored unencrypted, and automatic backups aren’t available.
• Defaults. Screenshots of the app are blocked, the vault locks when you press Back or lock the phone, and codes are shown without tapping (tap to reveal is off). If you unlock with biometrics, it asks for the password every two weeks.
• Forgetting the password loses the codes; there is no recovery.

Adding accounts

• Scan a QR code with the camera, scan an image of one, or enter the details manually. Aegis supports TOTP and HOTP codes, plus the Steam, Yandex and MOTP variants.
• Import from another app (Settings › Import & Export): 2FAS Authenticator, andOTP, Authenticator Plus, Authy, Battle.net Authenticator, Bitwarden, Duo, Ente Auth, FreeOTP and FreeOTP+, Google Authenticator, Microsoft Authenticator, Proton Authenticator, Steam, Stratum (Authenticator Pro), TOTP Authenticator, WinAuth, and plain-text lists of otpauth:// links.
• Some imports need root. For Authy, Battle.net, Duo, Microsoft Authenticator, Steam and FreeOTP 1.x, Aegis needs a file from inside that app’s private storage, which only root can read; Aegis can fetch it directly if you grant it root. Steam’s import works only with versions before 3.0. Bitwarden and Ente Auth exports must be unencrypted.
• Google Authenticator is easiest through its own Transfer codes QR codes, which need no root. Reading its database directly only works with versions up to 5.10.

Backups and exports

Aegis can’t go online, so backups are up to you, and they are off by default:

• Automatic backups write the vault to a folder you choose whenever it changes, keeping the last 5. They are “only supported for encrypted vaults”.
• Android cloud backups are a separate opt-in setting, also only for encrypted vaults. Android’s direct phone-to-phone transfer is always allowed.
• Export writes the vault as an Aegis file (encrypted or not), a web page or a text file of otpauth:// links. Only the Aegis file can be encrypted, and Aegis asks you to confirm before writing an unencrypted copy.
• Export for Google Authenticator shows QR codes Google Authenticator can scan, ten accounts each; only TOTP and HOTP accounts using SHA1 and 6 digits are included.

A security fix in this version

Version 3.4.3 fixes a bug where “a maliciously crafted icon pack could overwrite Aegis’ internal files if imported, including the vault file”. The developers’ advisory rates it High and lists versions 2.0 to 3.4.2 as affected; “exploitation requires a user to be socially engineered into importing an icon pack from an untrusted source.” Aegis has no official icon packs; its README links several community ones. Import icon packs only from sources you trust.

The permissions it asks for

Aegis declares 6 permissions, none of them internet access:

• Camera, to scan QR codes.
• Biometrics and fingerprint, for biometric unlock.
• Vibrate, for haptic feedback such as the warning when a code is about to expire.
• Run at startup, used only to refresh its two Quick Settings tiles (open the vault, open the scanner) after a reboot.

The code also contains the libsu library, which Aegis uses only for the root imports described above.

About this file

• This is the developer’s own build of version 3.4.3, signed by Beem Development with the certificate whose SHA-256 the README publishes (C6:DB:80:A8…). It is the same file as aegis-v3.4.3.apk on the project’s GitHub releases and on IzzyOnDroid, and the README says Google Play releases use the same key.
• F-Droid builds Aegis itself and signs it with F-Droid’s key, so its copy can’t update this one or be updated by it. The developers don’t publish on F-Droid themselves; their FAQ says new versions can take “up to a week” to appear there.
• The 6.9 MB file runs on ARM and x86, 32- and 64-bit, and needs Android 6.0 or later (required since Aegis 3.4). Our scan found no trackers.
• Aegis is licensed under the GPL-3.0.

libsu (root shell). Bundles libsu, a library for running commands in a root shell. (com.topjohnwu.superuser.NoShellException)

CPU types in this build: arm64-v8a (64-bit ARM, almost every phone since 2017); armeabi-v7a (32-bit ARM, older and budget phones); x86 (32-bit Intel, emulators); x86_64 (64-bit Intel, emulators and Chromebooks).

Versions currently kept in the IzzyOnDroid repository. We host and check only the newest one. Full changelog.