Aegis Authenticator

Aegis generates the six-digit login codes used as a second step when signing in. It holds the seeds those codes are derived from in a vault on the phone, encrypted with a password or unlocked with the fingerprint sensor.

It supports the two common code schemes, TOTP which changes on a timer and HOTP which advances per use, and reads the QR codes that services show when setting up two-factor sign-in. Entries can be grouped, searched and reordered, and icons help pick the right one out of a long list.

The part that separates it from the phone-vendor equivalents is the export: the vault can be written to an encrypted file and imported elsewhere, so moving to a new phone does not mean re-enrolling every account by hand. It works entirely offline; nothing is synced to a service.