Autothenticator quick answers
Do I need an account?
No. Everything works on one device without signing up. An account is only for sync.
Is it free?
Yes, on one device, for ever. Syncing across devices is part of Pro.
Can Winfrasoft see my codes?
No. Sync is end-to-end encrypted, and the key is made on your device. Our servers see only encrypted data.
Can Winfrasoft recover my vault if I lose everything?
No. Only your devices, your recovery kit or a backup with your recovery kit can. For work vaults, your organisation's key service can.
Why won't it fill the code on this site?
The site isn't bound to the account. If it's the real site, add it to the account (or use Bind this site to…). If Autothenticator warns that it looks like a lookalike, don't type the code in.
Why can't I see or copy my code?
The account is fill-only. You can turn that off in the account's settings, after a warning. A work account's fill-only rule can't be turned off.
My codes are wrong.
Check the device's clock: TOTP codes depend on it. The app warns if the clock is more than 15 seconds out (with sync).
Does it work on iPhone and Android?
Yes: native apps for Android, iPhone, iPad and Mac, plus Chrome, Edge and Firefox. Safari is included in the Apple app.
Can I move from iPhone to Android, or back?
Yes, with Move to a new device: no account needed, end-to-end encrypted.
I got a new phone. Will Google's or Samsung's transfer bring my codes?
No, on purpose. Use Move to a new device with the old phone, restore a backup, or sign in if you have sync.
I lost my phone and had no sync.
Restore your latest backup file with your recovery kit and your passphrase. Without a backup there's no way back, and you'll need to set 2FA up again with each service.
Can I import from Google Authenticator?
Yes: scan its Transfer accounts QR codes. Microsoft Authenticator, Authy and Duo don't let codes out, so those accounts are set up again; the move checklist helps.
Does it fill SMS codes?
On Android, yes. On iPhone and Mac, Apple's own keyboard suggestions already do it.
Does it do push notifications like Microsoft Authenticator's number matching?
No. Only standard one-time codes (TOTP and HOTP) and passkeys.
Can it replace my password manager?
No. It holds 2FA codes and passkeys, not passwords. It works alongside a password manager.
On Android, do I have to stop using my password manager's autofill?
Android allows only one autofill service. If you keep your password manager's, use Autothenticator's Quick Settings tile or notification to copy codes instead.
Can I use one app for work and personal accounts?
Yes, side by side, unless your organisation requires its own install. The organisation can't see your personal account.
Does my company see my personal codes?
No. Its policy, audit and recovery apply only to the work account.
Which identity providers can a business sign in with?
Microsoft Entra ID, Google Workspace, Okta, Ping, Twin Verify, OneLogin, JumpCloud, Auth0, Amazon Cognito, Cisco Duo, Keycloak and any other OpenID Connect provider. SAML-only providers aren't supported.
Where is my data stored?
In the EU: Microsoft Azure in the Netherlands, with failover to Ireland.
Is it open source?
No. Autothenticator is closed source. Its security doesn't rely on keeping the design secret: the vault key is made on your device and never reaches Winfrasoft, so our servers can't read your data whatever they run.