Set Up Aegis Authenticator: 13 Steps, 55 Min [2026]

Aegis Authenticator shipped version 3.4.3 on September 6, 2026, closing a vulnerability where a maliciously crafted icon pack could overwrite the app’s internal files, including the encrypted vault that holds every one time password a user has stored. The fix, credited to a reporter using the handle GICodeWarrior, landed alongside a new feature: support for importing encrypted exports from Proton Authenticator, according to the release notes published for the update. For an open source, offline first two factor authentication app with no company behind it and no subscription fee, that single release says a lot about why Aegis keeps showing up in conversations about two factor authentication security in 2026.

The sections below cover through the entire process of setting up Aegis Authenticator on Android: installing it, building an encrypted vault, migrating accounts away from Google Authenticator, andOTP, or Authy, importing from Proton Authenticator, and configuring backups that actually survive a lost or wiped phone. By the end you will have a repeatable backup and recovery pipeline, not just a list of two factor codes sitting unprotected on one device.

·

Google · Preferred Sources

Don't miss new tech stories on Google

Add TrendinTech once in the Google app and our stories appear in your news suggestions.

Add Now

What Is Aegis Authenticator and Why It’s Trending Right Now

Aegis Authenticator is a free, open source Android app built by Beem Development to generate and store TOTP and HOTP codes for two factor authentication. Unlike Google Authenticator or Microsoft Authenticator, Aegis does not tie your codes to a cloud account by default. Everything lives in a local, encrypted vault file that only you control, and the project is licensed under GPLv3, meaning the source code is public and auditable by anyone.

The app has been gaining attention for a few converging reasons. Google Authenticator’s own cloud sync feature drew criticism from security researchers for years over weak encryption on synced backups, pushing privacy conscious users toward local vault apps. Separately, andOTP, once a popular alternative, shows up repeatedly in Aegis’s own migration documentation as a supported import source, and its slower pace of updates has nudged a steady stream of its users toward Aegis instead. Add in the September 2026 security patch and the new Proton Authenticator import path, and Aegis Authenticator has become one of the more searched two factor authentication apps among Android users who want full control of their vault.

According to the official Google Play listing, “To make sure you will never lose access to your online accounts, Aegis Authenticator can create automatic backups of the vault to a location of your choosing.” That single sentence sums up the app’s core pitch: strong encryption paired with a backup model you control, rather than one tied to a vendor’s cloud.

How Aegis Authenticator’s Version History Got Here

Aegis has shipped on a fairly steady cadence through 2026, with each point release adding a small, specific capability rather than a sweeping rewrite. That pattern is worth tracking before you install anything, because it tells you whether the build you are about to download is actually current or quietly a step behind.

Version	Release date	Headline change
3.4.2	February 25, 2026	Maintenance release ahead of the 3.4.x import expansion
3.4.3	September 6, 2026	Adds encrypted Proton Authenticator import; fixes the icon pack file overwrite vulnerability

The gap between those two releases is the detail that matters most for this tutorial. Anyone who installed Aegis earlier in 2026 and never checked for an update has been running a build with a known, fixable file overwrite issue for months without realizing it. Checking the version number inside the app’s settings screen, and comparing it against whatever the project’s own release notes say is current, should be the very first thing you do before following any of the steps below.

Prerequisites: Devices, Versions, and What You’ll Need

Before starting, gather the following. None of it is exotic, but skipping a step here is the single biggest reason people lock themselves out of their own accounts during a 2FA migration.

• An Android phone or tablet. Aegis Authenticator is Android only; there is no official iOS build, which matters if you are coming from an iPhone based authenticator.
• Aegis Authenticator version 3.4.3 or later, downloaded from Google Play, F-Droid, or the GitHub Releases page for the project. Always install from one of these three sources, never a third party APK mirror.
• Access to the authenticator app, service, or account you are migrating from (Google Authenticator, Microsoft Authenticator, Authy, andOTP, 2FAS, FreeOTP, FreeOTP+, Steam, TOTP Authenticator, WinAuth, Proton Authenticator, or plain text codes), since several migration paths require you to export from the old app first rather than pulling data directly out of Aegis.
• A secure place to store a backup password that is different from your phone’s unlock PIN, ideally in a password manager.
• Optional but recommended: a cloud storage provider that supports Android’s Storage Access Framework, such as Nextcloud, for automatic encrypted backups, or a local sync tool like Syncthing if you prefer to keep backups off third party cloud storage entirely.
• 15 to 20 minutes of uninterrupted time per account you are migrating with root dependent extraction; migrations that use an in app export flow instead of root access take only a minute or two per account.

One prerequisite is worth repeating on its own: do not delete or disable two factor authentication on an old authenticator app until every single account has been verified as working inside Aegis. Treat the migration as additive until proven complete, then clean up the old app last.

Aegis Authenticator vs 2FAS vs Ente Auth vs Proton Authenticator vs Google Authenticator

Picking an authenticator app in 2026 means weighing open source transparency, cross device sync, and backup design against each other, because almost no app maximizes all three at once. The table below, cross checked against a feature comparison of Google Authenticator alternatives, lays out how Aegis stacks up against the apps people most often compare it to.

App	Open source	Cross device sync	Encrypted backup	Platform	Price
Aegis Authenticator	Yes (GPL-3.0)	No, manual export only	Yes, vault file (AES-256-GCM)	Android only	Free
2FAS	Yes	Account free sync, browser pairing	Yes	Android and iOS	Free
Ente Auth	Yes (AGPL-3.0)	Yes, cloud account based	Yes, end to end encrypted	Android, iOS, web, desktop	Free, paid tiers for storage
Proton Authenticator	Partially	Yes, via Proton account	Yes, encrypted export supported by Aegis	Android, iOS, desktop, web	Free, paid tiers for extras
Google Authenticator	No	Yes, Google account based	Tied to Google account	Android and iOS	Free
Microsoft Authenticator	No	Yes, Microsoft account based	Tied to Microsoft account	Android and iOS	Free

The practical takeaway: Aegis Authenticator trades cross device convenience for full local control. If you need codes to appear automatically on a second phone the moment you add them, Ente Auth or 2FAS fit that workflow better. If you want your two factor secrets to never touch a vendor’s server unless you explicitly choose to put them there, Aegis is built for exactly that. According to Ente’s own comparison page, independent reviewers at Cure53 have examined Ente’s encryption design and the shared server infrastructure behind its Auth product, while no equivalent independently published audit of Aegis Authenticator currently exists. That is not a mark against Aegis so much as a reflection of its smaller, volunteer driven maintenance model, but it is worth knowing before you commit a dozen accounts to any single app’s security story.

Step 1 and 2: Download, Verify, and Install Aegis Authenticator 3.4.3

Start on the Google Play Store listing for Aegis Authenticator and confirm the version number shown matches 3.4.3 or newer before installing. If you prefer to avoid the Play Store entirely, F-Droid carries the same build, and the project’s GitHub Releases page hosts signed APKs for manual installation.

If you choose the manual APK route, verify the file’s checksum before installing anything. This single habit catches tampered downloads before they ever touch your phone.

sha256sum aegis-3.4.3-release.apk
# Compare the output against the sha256 value published on the
# project's GitHub Releases page for that exact version. If the two
# values do not match character for character, delete the file and
# download it again from the official source.

With Developer Options enabled and USB debugging turned on, you can also install the verified APK straight from a computer using Android Debug Bridge, which is handy if you are setting up a secondary or spare device as a recovery phone.

adb devices
adb install aegis-3.4.3-release.apk
# Expect "Success" in the terminal output. If you see
# INSTALL_FAILED_UPDATE_INCOMPATIBLE, uninstall any older
# sideloaded build of Aegis first, then retry the install.

Launch the app once installation finishes. You will land on a short welcome screen before Aegis asks you to set up vault protection, which is the actual first security decision of the entire setup.

Step 3 and 4: Create Your Encrypted Vault and Set a Master Password

Aegis stores every token inside a single vault file. By default, Google Play’s listing for the app notes that the vault “will be encrypted using strong cryptography” once you set a password, and that encryption is built on AES-256-GCM, a modern authenticated cipher, with the password itself run through scrypt before it ever touches the encryption key. That combination matters because scrypt is deliberately slow and memory hungry, which makes brute forcing a stolen vault file far more expensive than it would be against a weaker, faster hashing scheme.

When Aegis prompts you to protect the vault, choose a password you have never reused anywhere else, ideally one generated by a password manager at 20 characters or more. This password is not your phone’s screen lock PIN, and the two should never be the same string. Write it down somewhere offline as a last resort recovery option, because there is no password reset flow. Lose the password and lose the vault file at the same time, and every code inside it is unrecoverable by design, which is the entire point of real encryption.

Confirm the password, and Aegis generates an empty, encrypted vault ready to receive accounts. At this point the app is functional but holds nothing useful yet, so the next steps are about getting your actual accounts into it.

Step 5: Enable Biometric Unlock Through Android Keystore

Typing a 20 character password every time you need a six digit code gets old fast, which is why Aegis supports biometric unlock layered on top of the master password rather than instead of it. Under the hood, biometric unlock in Aegis is handled through the Android Keystore system, Android’s hardware backed credential storage, rather than Aegis storing your fingerprint or face data itself.

Open Aegis’s settings, find the security section, and enable fingerprint or face unlock if your device supports it. You will be asked to authenticate once to confirm the biometric method works, and from then on, opening the vault day to day uses your fingerprint while the underlying password still protects the vault file itself if it is ever extracted from the device. This is an important distinction: biometric unlock is a convenience layer for daily use on your own phone, not a replacement for the password that actually encrypts the vault on disk.

Step 6 and 7: Add Accounts Manually, by QR Code, and by Link

With the vault created, tap the add button inside Aegis. You have three practical ways to add a new account that was never set up in another authenticator before:

1. Scan the QR code shown on the service’s two factor setup page using Aegis’s built in scanner. This is the fastest and least error prone method.
2. Paste an otpauth link directly if the service gives you one instead of a QR code, which some self hosted tools and developer dashboards do.
3. Enter the secret key, issuer name, and account name by hand if neither a QR code nor a link is available, choosing TOTP or HOTP to match what the service specified.

After adding an account, Aegis immediately starts generating six digit codes on the usual 30 second TOTP cycle. Test the code against the service you just added it for before moving to the next account, since catching a typo in the secret key now is far easier than discovering it later when you are locked out.

Step 8: Migrate From Google Authenticator, Authy, and andOTP

Moving existing accounts is where most people actually spend their time, and Aegis documents import paths for a long list of other authenticator apps, including Google Authenticator, Microsoft Authenticator, Authy, andOTP, FreeOTP, FreeOTP+, 2FAS, Steam, TOTP Authenticator, WinAuth, and plain text exports. Not every path works the same way, and that distinction matters before you start.

Google Authenticator added an official export feature a few years ago that generates a QR code containing multiple accounts at once. Inside Aegis, choose the import option for Google Authenticator, scan that export QR code, and Aegis pulls in every account it contains in a single pass rather than one at a time.

Authy does not offer a clean official export, so migrating from it typically means re adding each account from scratch using the original QR code or secret key from each service, since Authy’s own backup format is proprietary and encrypted to Authy’s own cloud. Treat an Authy migration as a fresh setup for each account rather than a bulk import.

andOTP is one of the apps Aegis explicitly lists as a supported import source, which is a big part of why so many former andOTP users land on Aegis specifically. Export an encrypted or plain backup from andOTP’s own backup menu, then use Aegis’s import screen to select the andOTP format and point it at that exported file. Some import paths for other apps require root access, particularly when pulling data directly out of another app’s private storage rather than using that app’s own export feature, so check which situation applies to you before assuming you need a rooted device.

Step 9: Import Encrypted Proton Authenticator and 2FAS Exports

This is the feature new in version 3.4.3: Aegis now accepts encrypted exports straight from Proton Authenticator, closing a gap that previously forced Proton Authenticator users to re enter every account by hand. Export your vault from Proton Authenticator using its own backup function, keeping the file encrypted rather than converting it to plain text, then open Aegis’s import menu, select Proton Authenticator as the source format, choose the exported file, and enter the export’s password when prompted.

2FAS exports work through a similar import flow and are listed among Aegis’s supported source formats as well. If you are coming from 2FAS specifically because you want Aegis’s fully offline model instead of 2FAS’s account free sync, export your 2FAS vault first, then import it the same way you would a Proton Authenticator file, matching the correct format in the dropdown so Aegis parses the file correctly.

Source app or format	Import method	Root access needed
Google Authenticator	Official export QR code	No
2FAS	Vault export file	No
Proton Authenticator	Encrypted export file (added in 3.4.3)	No
andOTP	Backup file (plain or encrypted)	No
FreeOTP / FreeOTP+	Export file	No
Steam	Extraction from app storage	Usually yes
TOTP Authenticator, WinAuth	Export or plain text file	Depends on source
Plain text	Manually formatted file	No

Step 10 and 11: Configure Automatic Encrypted Backups and Cloud Sync

Once your accounts are in, the single most important thing left to do is make sure losing your phone does not mean losing every one of those accounts too. Aegis’s own project FAQ draws a clear line here: “Exporting is done manually and backups are done automatically,” and critically, “the format of the vault file is exactly the same for both,” meaning a manual export and an automatic backup are interchangeable for recovery purposes.

Open Aegis’s settings and find the backups section. Turn on automatic backups and choose a destination folder. If your cloud provider supports Android’s Storage Access Framework, which Nextcloud does, Aegis can write encrypted backups straight to that cloud folder every time your vault changes, so a new backup exists without you having to remember to make one. Google Play’s own listing confirms this directly: “If your cloud provider supports the Storage Access Framework of Android (like Nextcloud does), it can even create automatic backups to the cloud.”

If you would rather avoid third party cloud storage entirely, Aegis’s own contributors describe a common alternative setup: “Another common setup is to configure Aegis to back up to a folder on local storage of your device and then have a separate app (like Syncthing) sync that folder anywhere you want.” That approach keeps the encrypted backup file moving between your own devices directly, without a cloud provider ever holding a copy, encrypted or otherwise.

# Example Syncthing folder setup for an Aegis local backup folder
# 1. In Aegis settings, set the backup location to:
#    /storage/emulated/0/Aegis_backups/
# 2. In Syncthing, add that same path as a synced folder
# 3. Share the folder with a second device running Syncthing
# 4. Confirm the .json backup file appears on the second device
#    after Aegis writes its next automatic backup

Step 12: Export a Manual Vault Backup and Restore on a New Phone

Automatic backups cover the everyday case, but it is worth creating one manual export too, right after your migration is complete, and storing it somewhere separate from your phone entirely, such as an encrypted USB drive kept in a drawer. From Aegis’s settings, choose the manual export option, select encrypted format rather than plain text, and save the resulting file to that offline location.

Restoring on a new phone follows the reverse path. Install Aegis 3.4.3 on the new device, and instead of creating a brand new empty vault, choose the option to restore from an existing vault file. Point it at your backup, whether that is the automatic backup from your cloud folder or the manual export from your offline drive, enter the vault’s password, and every account, icon, and token reappears exactly as it was on the old phone.

# Pulling a backup off an old phone before wiping it, using adb
adb shell
run-as com.beemdevelopment.aegis
# (If direct access is restricted, instead copy the backup file
# from the Storage Access Framework destination folder you set
# in Step 10, which does not require shell access at all.)
exit
adb pull /sdcard/Aegis_backups/aegis_backup_20261015.json ./

Test every single migrated account on the new phone before you decommission the old one. A two factor code that worked yesterday on the old device but fails on the new one almost always means the vault restore happened correctly but the account’s time sync or secret needs a second look, not that the whole vault is broken.

Step 13: Harden Your Vault With Panic Mode, Lock Timers, and Icon Pack Caution

The last step is tightening the defaults. Set an auto lock timer so Aegis re locks itself after a short period of inactivity rather than staying unlocked in the background indefinitely. Review the app’s screenshot blocking option and leave it enabled so codes cannot be captured by other apps or accidentally included in a screen recording.

Given that the 3.4.3 patch exists specifically because a malicious icon pack could overwrite internal Aegis files, only install icon packs from the app’s official, trusted sources, and keep Aegis itself updated promptly whenever a new version ships. An encrypted vault is only as safe as the app surrounding it, and this particular vulnerability is a direct reminder that even a well designed local vault app has an attack surface beyond the encryption itself.

Complete Working Project: A Full Backup and Recovery Pipeline for Aegis

Putting every step together gives you a complete, working pipeline rather than a pile of disconnected settings. Here is what the finished setup looks like end to end:

1. Aegis 3.4.3 installed on your primary phone, vault protected by a unique 20+ character password and biometric unlock.
2. Every account migrated from your old authenticator, verified one by one against the live service before the old app was removed.
3. Automatic encrypted backups writing to a Nextcloud folder through Storage Access Framework every time the vault changes.
4. That same backup folder also synced locally to a second device through Syncthing, so the cloud provider is never the only copy.
5. One additional manual, encrypted export stored offline on a USB drive, refreshed any time you add a meaningful number of new accounts.
6. A spare Android device, or at minimum a documented restore procedure, ready to receive the vault file and password if your primary phone is lost, stolen, or destroyed.

To keep the pipeline honest, schedule a recurring reminder, not inside Aegis but as a calendar event or a simple cron job on a home server, that prompts you to actually test a restore every few months rather than assuming the backup works because it exists.

# Example cron entry on a home Linux server that checks whether
# the synced Aegis backup folder has been updated in the last 14 days
# and emails an alert if it has gone stale
0 9 * * 1 find /mnt/synced/Aegis_backups -name "*.json" -mtime -14 \
  | grep -q . || echo "Aegis backup is stale" | mail -s "Check Aegis backup" [email protected]

That closes the loop: a stale or missing backup gets flagged automatically instead of being discovered the day you actually need it.

Common Pitfalls When Setting Up and Backing Up Aegis Authenticator

Most Aegis problems trace back to one of these mistakes, almost all of which are avoidable with a little patience during setup.

1. Reusing your phone’s screen lock PIN as the vault password. If someone gets your phone unlocked, they get the vault too. The vault password needs to be a separate, stronger secret.
2. Deleting the old authenticator app before verifying every migrated account. Verify first, delete last, with no exceptions, especially for accounts you rarely log into.
3. Treating automatic backups as a substitute for an offline manual export. A cloud account compromise or sync failure can affect the automatic backup too; the offline copy is your real fallback.
4. Forgetting the vault password with no recovery option in place. Aegis cannot reset a forgotten password by design. Store it in a password manager or written down securely, not only in your memory.
5. Installing Aegis APKs from unofficial mirrors instead of Google Play, F-Droid, or the project’s own GitHub Releases. This is exactly the kind of third party source that can carry a tampered build.
6. Ignoring app updates after a security patch like 3.4.3 ships. Delaying the update leaves the previously disclosed vulnerability open on your device for no reason.
7. Assuming every migration path works the same way. Some imports need root access to pull data from another app’s private storage; others work through a simple export file. Confirm which situation applies before you start.

Troubleshooting Aegis Authenticator: Fixes for Common Issues

These are the issues that come up most often during setup, migration, and backup, along with what actually fixes each one.

1. A migrated code does not match the service. Double check that the account was set up as TOTP versus HOTP correctly, since mixing the two produces codes that look valid but never match.
2. Codes work for a moment then stop matching. This usually points to the phone’s system clock drifting out of sync. Enable automatic network time in Android’s date and time settings rather than a manual clock.
3. The Google Authenticator export QR code fails to scan. Increase screen brightness on the device showing the QR code and hold the scanning phone steady about six inches away; Google’s export QR codes are denser than a single account’s QR code and more sensitive to blur.
4. Import from andOTP reports an invalid file. Confirm the export was saved from andOTP’s actual backup menu rather than copied from a different folder, and that you selected the matching encrypted or plain option inside Aegis to correspond with how the file was exported.
5. Biometric unlock stops working after a phone update. Re enroll the fingerprint or face profile in Android’s own settings first, then re enable biometric unlock inside Aegis, since Android Keystore entries can be invalidated by certain system updates.
6. Automatic backups are not appearing in the Nextcloud folder. Re grant the Storage Access Framework permission inside Aegis’s backup settings, since Android periodically revokes persisted folder permissions after long periods of inactivity.
7. The app warns about a corrupted vault after a restore. Confirm you selected the correct backup file and entered the exact password used when that specific backup was created, since an older backup may use a different password than your current one.
8. Proton Authenticator or 2FAS import fails with a parsing error. Confirm you are running Aegis 3.4.3 or later, since the Proton Authenticator import path did not exist in earlier versions, and re export from the source app if the file was created before you updated it.
9. Icon packs suddenly disappear or the app behaves oddly after installing a custom icon theme. This matches the exact failure mode patched in 3.4.3. Update to the latest version immediately and avoid installing icon packs from unverified sources.

Advanced Tips for Power Users and Teams

Once the basic setup is solid, a few additional habits push Aegis Authenticator from functional to genuinely resilient.

Group accounts using Aegis’s built in groups and tags feature so that work accounts, personal accounts, and financial accounts are visually separated, which matters more as the vault grows past 20 or 30 entries. Use the search function rather than scrolling once your account list gets long.

For small teams managing shared service accounts, do not treat Aegis as a multi user tool, since it has no built in sharing, access control, or audit log for who viewed which code. Instead, keep one designated vault on a team controlled device for shared accounts, and use Aegis’s individual, personal vaults for everyone’s own accounts, which better matches how the app’s local, single user model was actually designed.

Consider pairing Aegis with a hardware security key, such as a FIDO2 device, as the primary two factor method on your most important accounts (email, password manager, domain registrar), and keep Aegis as the method for every other service. That way the small number of accounts that would be most damaging if compromised do not depend on a phone at all, while Aegis still handles the bulk of everyday logins conveniently.

Finally, periodically review the accounts stored inside Aegis and remove entries for services you no longer use. A vault full of dead accounts is not a security risk by itself, but it does make it harder to notice when something genuinely new and unexpected shows up in the list.

Why Local Encrypted Backups Matter More Than Ever in 2026

SIM swapping, cloud account breaches, and phone theft are not hypothetical risks for anyone carrying a dozen or more two factor accounts around in their pocket. When two factor codes live inside a cloud account, as they do by default in Google Authenticator and Microsoft Authenticator, compromising that single cloud login can hand an attacker every synced code at once. Aegis Authenticator’s local vault model removes that specific failure path entirely, since there is no account to phish or no cloud login that unlocks the vault remotely. The tradeoff, as covered earlier Is that the backup discipline shifts onto you instead of a vendor’s infrastructure team.

That shift is exactly why the backup and recovery pipeline built in Steps 10 through 12 matters as much as the initial installation. A vault with strong AES-256-GCM encryption and a 20 character password is only as useful as the last backup that actually succeeded. Phone theft, water damage, and a failed Android update are mundane events, not edge cases, and each one can wipe a device without warning. The difference between someone who loses an afternoon reconfiguring two factor codes and someone who loses access to their email, bank, and work accounts for days often comes down entirely to whether an automatic backup was actually running, and whether it was tested even once before it was needed.

Security researchers and privacy advocates have pushed Android users toward exactly this kind of local first model for years, arguing that convenience features bundled into major platform accounts quietly expand the blast radius of a single compromised login. Aegis Authenticator’s design, an encrypted vault file that moves at the pace you choose, to the destination you choose, is a direct answer to that concern, even if it asks a little more of the user upfront than simply tapping “enable” on a built in cloud sync toggle.

Output Examples: What a Correctly Configured Vault Looks Like

After finishing this tutorial, the Aegis home screen should show a scrollable list of accounts, each with a six digit TOTP code counting down on a 30 second cycle (or an eight digit HOTP code that advances only when manually tapped). The settings screen’s backup section should display a timestamp showing the most recent automatic backup, updated within the last day if you have been actively adding or editing accounts.

A successful manual export produces a single file, typically named with the app’s default naming pattern and a .json extension, that opens as unreadable encrypted ciphertext in a plain text editor, confirming the export itself is encrypted rather than a plain text list of your secrets sitting in a file manager.

A successful restore on a new device reproduces the exact same account list, group structure, and icons as the source vault, with every code matching the live service on the first try, which is the real confirmation that the whole pipeline, not just the install, actually works.

Frequently Asked Questions

Is Aegis Authenticator available on iPhone?
No. Aegis Authenticator is Android only. iPhone users looking for a similar open source, locally encrypted model more commonly turn to Ente Auth or 2FAS, both of which ship iOS apps.

What encryption does Aegis use to protect my vault?
Aegis encrypts the vault with AES-256-GCM, with your master password processed through scrypt before it becomes the encryption key, and biometric unlock handled separately through Android’s hardware backed Keystore.

Can I sync Aegis across two phones automatically?
Not natively. Aegis has no built in cloud sync. You can approximate sync by pointing automatic backups at a shared cloud folder that supports Android’s Storage Access Framework, or by syncing a local backup folder between devices with a tool like Syncthing, but the vault itself stays local to each device.

What happens if I forget my vault password?
There is no password recovery. The vault is encrypted specifically so that nobody, including the app’s own developers, can unlock it without the correct password. Losing the password means losing access to that vault’s contents permanently.

Does migrating from andOTP to Aegis require root access?
No, as long as you export your backup using andOTP’s own built in backup feature first. Root access is only needed for certain migration paths that pull data directly out of another app’s private storage rather than using that app’s own export function.

Is the vulnerability fixed in version 3.4.3 something I should worry about if I update promptly?
Updating to 3.4.3 or later removes the specific file overwrite issue tied to maliciously crafted icon packs. As with any security patch, the main risk exists for users who delay updating, not for those running the current version.

Can Aegis import directly from Proton Authenticator?
Yes, starting with version 3.4.3, Aegis added support for importing encrypted exports generated by Proton Authenticator, which was not possible in earlier versions of the app.

Is Aegis Authenticator actually free, with no paid tier or subscription?
Yes. Aegis Authenticator is free and open source under the GPLv3 license, with no account requirement, no subscription, and no paid tier for any of its backup or import features.

Related Coverage

• Best Antivirus Software 2026: Set Up in 13 Steps, 50 Min
• Windows 11 Defender Setup: 13 Steps, 60 Min [2026]
• Set Up NordVPN Meshnet: 13 Steps, 60 Minutes [2026]
• Cemu Wii U Emulator Setup: 13 Steps, 90 Min [2026]
• Gemini API Key Setup: Build an App in 13 Steps [2026]