Ydenticator vs Authy
Authy is one of the most popular authenticator apps because it syncs your TOTP seeds across devices and backs them up to the cloud. Ydenticator takes the opposite approach: seeds never leave the device, and every code request requires a proprietary challenge that proves the device is in the right hands. Here is how they compare and when to choose each.
How Authy works
Authy implements standard TOTP (RFC 6238) for third-party services. When you scan a QR code, Authy stores the shared secret and uses it to generate a 6-digit code every 30 seconds. The key difference from Google Authenticator is convenience: Authy encrypts your seeds and syncs them across phones, tablets, and desktop apps using a backup password and your phone number.
That cloud sync is a double-edged sword. If your phone is lost or stolen, you can restore your codes on a new device by verifying your phone number and entering the backup password. But the same mechanism means an attacker who compromises your phone number (via SIM swap or carrier account takeover), guesses a weak backup password, or gains access to Authy's cloud infrastructure can potentially access your seeds.
How Ydenticator works
Ydenticator replaces the "hold a seed, print a code" model with a challenge on every request. To generate a code you answer one randomly chosen question from your private 30-question pool. The answer proves three things at once:
- Something you know — the answer to the question.
- Something you are — your answer pattern maps to your personality profile (Explorer, Thinker, Performer).
- Something you own — the device holding a non-extractable AES-GCM-256 key, backed by Windows Hello or the iOS Secure Enclave via WebAuthn PRF.
For TOTP-based services (banks, GitHub, Infomaniak, etc.), Ydenticator stores seeds on-device encrypted with that same hardware-bound key. There is no cloud backup to compromise, because the seeds never leave the device.
Side-by-side comparison
| Property | Authy | Ydenticator |
|---|---|---|
| Algorithm | TOTP (RFC 6238) | Challenge + TOTP for third-party seeds |
| Factors delivered | Something you have | Know + are + own on every code |
| Seed storage | Encrypted cloud backup + device | Device only, AES-GCM-256, hardware-bound key |
| Cloud backup | Yes — central to recovery | None — device-local by design |
| Multi-device | Yes — sync across phones, tablets, desktop | Yes — authorized enrollment QR code from an existing device |
| Recovery | Restore from cloud backup + SMS verification | Admin-authorized device re-enrollment |
| Cloud-attack surface | Backup password, phone number, sync infrastructure | None — no cloud copy of seeds exists |
| Phishing resistance | Standard TOTP — real-time phishing possible | Stronger — attacker must also answer your question |
| Install | iOS / Android / desktop app | Any modern browser (PWA) |
Where Authy wins
- Seamless multi-device sync — start on your phone, finish on your laptop.
- Fast recovery after a lost or broken phone through cloud backup.
- Mature, widely supported app with broad service compatibility.
- Familiar, low-friction flow: open the app, read the code.
Where Ydenticator wins
- Seeds never leave the device — no cloud backup, password, or phone-number recovery to compromise.
- All three classical authentication factors on every code, not just "something you have".
- Hardware-bound AES-GCM-256 key via Windows Hello / Secure Enclave (WebAuthn PRF).
- Questionnaire challenge makes real-time phishing and seed theft far less useful to an attacker.
- Works as a PWA in any modern browser — no app-store install, no vendor lock-in.
Which should you pick?
If you value convenience above all — multiple devices, instant recovery, and a traditional app experience — Authy is the more convenient choice. If your threat model includes SIM-swap attacks, cloud backup breaches, or targeted phishing, and you want a device-bound authenticator that adds a personal challenge to every code, Ydenticator is the stronger fit. Many users keep Authy for low-stakes accounts and use Ydenticator for the accounts they cannot afford to lose.