How to set up Aegis Authenticator for 2FA

Two-factor authentication (2FA) means you need two things to log in: your password and a short code that changes every 30 seconds. If someone steals your password, they still cannot get in.

Why not text messages (SMS)?

Codes sent by SMS can be stolen with a "SIM swap", where a criminal convinces the phone company to move your number to their SIM. They also tie the account to your phone number. An app like Aegis makes the codes on your own phone, with no number needed.

Step 1: Install Aegis

Follow the order in how to download apps safely:

1. First choice: the official website (getaegis.app) or its official GitHub releases page.
2. Second choice: F-Droid.
3. Third choice: Aurora Store.

Step 2: Create your vault

1. Open Aegis and tap Create a new vault.
2. Choose Password. Pick a long passphrase and store it in your password manager (KeePass guide).
3. You can also turn on Biometric unlock, but remember that a strong passphrase is safer if your phone is taken.
4. Aegis encrypts your list of codes with this password.

Step 3: Add an account

1. On the website you want to protect, find Security > Two-factor authentication and choose Authenticator app.
2. In Aegis tap the + button.
3. Choose Scan QR code and point the camera at the code on the website. If you cannot scan, choose Enter manually and type the secret key.
4. Check the name looks right, then Save.
5. Type the 6-digit code from Aegis into the website to confirm.

Step 4: Save the recovery codes

Websites show recovery codes when you turn on 2FA. Save them in your password manager, or print them and keep them somewhere safe. They are your way back in if you lose your phone.

Step 5: Make a backup (important!)

1. In Aegis open Settings > Backups.
2. Choose a folder and turn on automatic encrypted backups.
3. Copy the backup file to a safe place regularly, for example to Cryptomator cloud storage.
4. Test it once by restoring on a spare profile.

If you lose your phone and have no backup and no recovery codes, you can be locked out forever.

Good habits

• Turn 2FA on for your email first, then everything important.
• Use the app lock and screenshot protection (Aegis blocks screenshots by default).
• Do not type a code into a page you reached from a link. Open the website yourself.
• Consider a hardware key (YubiKey) for your most important account.

See also what to do if your phone is lost or seized.