Softonic reported this week that the official Pokémon social account was compromised and used to push a crypto scam. The play-by-play matches half the account takeover stories from the last year: one weak factor, no hardware key, no proper authenticator. It is also a good moment to line up the authenticator apps for desktop that actually make an account-takeover attempt boring, and to note that Authy quietly retired its desktop app in 2024, so a lot of people are still looking for a replacement.
Every pick below stores TOTP codes with real encryption, most sync securely between devices, and none of them are a vendor lock-in you cannot walk away from.
What to look for in a desktop authenticator
- Local encryption of the seed database (nothing in plaintext on disk)
- Cross-device sync that does not put the seeds through a vendor’s servers unencrypted
- Backup and export that you can move to another authenticator without losing codes
- Optional hardware-key support (Yubikey, Nitrokey) for high-value accounts
- Open source, ideally, because a black-box authenticator is a bad idea
Quick comparison
| App | Best for | Cost | Sync | Open source |
|---|---|---|---|---|
| Ente Auth | Free, e2e-encrypted, cross-device | Free | End-to-end cloud | Yes |
| Bitwarden | Password manager plus TOTP | Free, paid ~$10/year | End-to-end cloud | Yes |
| 2FAS | Free, private, browser-linked | Free | End-to-end backup | Yes |
| KeePassXC | Local-first, no cloud | Free | Whatever syncs your vault | Yes |
| 1Password | Family and team accounts with TOTP | Paid, from ~$2.99/month | End-to-end cloud | No |
| Proton Pass | Proton users who want one account | Free, paid tiers | End-to-end cloud | Yes |
| Yubico Authenticator | Hardware key holds the secrets | Free (with a Yubikey) | On the key itself | Partly |
The apps
1. Ente Auth — best free, e2e-encrypted, cross-device
Ente Auth is the free, open-source authenticator from the same team behind Ente Photos. Desktop clients on Windows, macOS, and Linux mirror the mobile apps, seeds sync end-to-end encrypted through Ente’s cloud, and export to plain text or another authenticator is a menu item, not a fight. No account is required for local-only use.
Where it falls short: Younger project than 2FAS or Bitwarden. Small feature set on purpose.
Pricing:
- Free, open source.
Platforms: Windows, macOS, Linux, Android, iOS, web.
Download: ente.io/auth · GitHub
Bottom line: The right first pick for anyone who wants a proper cross-device authenticator without paying for one.
2. Bitwarden — best password manager plus TOTP
Bitwarden stores passwords, passkeys, and TOTP secrets in one vault, and its desktop client on Windows, macOS, and Linux fills codes directly into the browser via the extension. The TOTP feature sits behind the paid tier (around $10 a year for personal), which is still the cheapest bundle on this list.
Where it falls short: TOTP is a Premium feature; the free tier stores everything but the codes. Vaulting passwords and 2FA in the same tool is a single-basket argument.
Pricing:
- Free vault.
- Premium from around $10 per year for individuals; Families around $40 per year.
Platforms: Windows, macOS, Linux, browsers, Android, iOS.
Download: bitwarden.com/download
Bottom line: The right pick when you already use Bitwarden and you want one app to hold everything.
3. 2FAS — best free, private, browser-linked
2FAS is the free, open-source authenticator with a slick trick: the browser extension pairs with the mobile app so you can approve a TOTP on desktop without keying it in. On the desktop side, that is the closest thing to Authy’s old desktop UX that still exists.
Where it falls short: No standalone desktop client. Desktop UX depends on the browser extension plus the mobile app.
Pricing:
- Free, open source.
Platforms: iOS, Android, browser extensions (Chrome, Firefox, Edge, Safari).
Download: 2fas.com
Bottom line: The right pick for anyone who wants Authy’s fill-from-desktop experience without paying and without the Authy account.
4. KeePassXC — best local-first, no cloud
KeePassXC stores TOTP secrets alongside passwords in a KDBX file that never leaves your machine unless you put it somewhere yourself. Codes appear next to their entries in the desktop client, and the auto-type feature can fire the code into the browser with a keystroke. Sync is your problem: Syncthing, iCloud, or a NAS share does it.
Where it falls short: Sync is DIY. No polished mobile companion from the same team (KeePass2Android and Strongbox fill in).
Pricing:
- Free, open source.
Platforms: Windows, macOS, Linux.
Download: keepassxc.org
Bottom line: The right pick when you want zero cloud and you already keep passwords in a KDBX file.
5. 1Password — best family and team accounts with TOTP
1Password stores TOTP secrets in every vault tier, fills them into the browser from the desktop app, and shares them cleanly through Family or Team vaults (the “hand my parents the Netflix TOTP” problem). Its Watchtower feature actively flags accounts that offer 2FA and are not using it.
Where it falls short: Paid-only. Closed-source client.
Pricing:
- Trial.
- Individual from around $2.99 per month, Families from around $4.99 per month.
Platforms: Windows, macOS, Linux, Android, iOS, browsers.
Download: 1password.com/downloads
Bottom line: The right pick for a family or team that wants shared TOTP and a first-class desktop app.
6. Proton Pass — best for Proton users who want one account
Proton Pass is Proton’s password manager with a built-in authenticator. Everything sits in the same Proton account you already use for Mail, Drive, and VPN, syncs end-to-end encrypted, and works on Windows, macOS, and Linux with the same UI as the browser extension.
Where it falls short: Value depends on caring about Proton. Free tier’s TOTP has a device cap.
Pricing:
- Free tier with limits.
- Included in Proton Unlimited (~$9.99 per month or bundled).
Platforms: Windows, macOS, Linux, browsers, Android, iOS.
Download: proton.me/pass/download
Bottom line: The right pick for existing Proton customers who want one bill and one account for everything.
7. Yubico Authenticator — best hardware key holds the secrets
Yubico Authenticator flips the model: the TOTP seeds live on a Yubikey, and the desktop app just reads them from the key when you plug it in. Nothing sensitive sits on the disk, and losing the laptop does not lose the codes — losing the Yubikey does.
Where it falls short: Requires buying a Yubikey (from around $50). Codes tied to a physical device, so cross-device workflows mean two Yubikeys.
Pricing:
- App is free.
- Yubikey 5 series from around $50, Security Key from around $25.
Platforms: Windows, macOS, Linux, Android, iOS.
Download: yubico.com/products/yubico-authenticator
Bottom line: The right pick for high-value accounts where “the codes are on the disk” is unacceptable.
How to pick the right one
If you want free, open, cross-device, and simple: Ente Auth.
If you already pay for a password manager: Bitwarden (add Premium for TOTP) or 1Password (built in).
If Authy’s desktop workflow was what you liked: 2FAS, with the browser extension paired to the mobile app.
If you insist on zero cloud: KeePassXC, and sync the vault yourself.
If you live inside Proton: Proton Pass.
If the account matters enough that seeds should never touch the disk: Yubico Authenticator with a Yubikey.
FAQ
Why did Authy shut down its desktop app?
Twilio announced the retirement of the Authy desktop apps on Windows, macOS, and Linux in 2024. Existing users had a window to migrate, and Authy’s desktop clients no longer sync new codes. Ente Auth and 2FAS are the two most-recommended replacements for that specific workflow.
Is it safe to store TOTP secrets in a password manager?
It is a tradeoff. Storing them alongside your passwords consolidates the risk, but a properly configured password manager (strong master password, hardware-key 2FA on the manager itself) is still stronger than SMS. Ente Auth or Yubico Authenticator keep the risk separate if you prefer.
What is the best free authenticator app for desktop?
Ente Auth, KeePassXC, and 2FAS (paired with the mobile app) all deliver full authenticator features without a subscription.
Can I export my TOTP codes from one authenticator to another?
Ente Auth, 2FAS, Bitwarden, KeePassXC, and Proton Pass all export codes in a portable format. Google Authenticator’s export is QR-based; import into any of the above. Yubico Authenticator does not export because the codes live on the key.
Do these apps support passkeys?
Bitwarden, 1Password, Proton Pass, and KeePassXC (with recent versions) all handle passkeys next to TOTP. Ente Auth focuses on TOTP; passkey support is on their roadmap.
