Comparison

Fob vs Aegis Authenticator: An Honest Comparison

Published April 27, 2026. Recommends Aegis over Fob in the cases where Aegis is the right answer.

Aegis is the authenticator the security-conscious Android community recommends, and for good reason. It is FOSS under GPL-3.0, locally encrypted with strong defaults (Argon2id, AES-256-GCM), maintained openly by community contributors, and asks for nothing more than your password. If you have landed here from a thread on r/privacy or a coworker's "use Aegis" reply, you already know the case for it.

This page is for the moment that case stops fitting. The two structural tradeoffs to understand up front are: FOSS-with-readable-source versus closed-source-with-verifiable-architecture, and Android-only-by-design versus cross-platform-on-roadmap. Neither side dominates. The right pick depends on which tradeoff you are actually optimizing for.

We will not pretend Fob is the better answer for every Aegis user. For some readers, Aegis is the right answer, and we will say so plainly and tell you when.

The 60-second answer

Either path is reversible. Aegis exports an encrypted JSON; Fob exports the same otpauth-migration QR every other serious app reads. You are not locked into either choice.

Side by side

A few rows are worth a closer look. On encryption, the two apps are closer than they look. Aegis encrypts the local vault with AES-256-GCM and derives the key from your password using Argon2id. Fob does the same on the local database, and extends the same pattern to the cloud backup layer so the server holds an encrypted blob it cannot decrypt. The architecture is at fob.codes/security. The difference is not the primitive; it is the trust model around it.

On that trust model: Aegis lets a motivated user read the repository and confirm the encryption is wired up correctly. That is real and valuable. Fob takes the closed-source path and offsets it a different way: the encryption is verifiable from how the app behaves, the full architecture is published at fob.codes/security, and export-always means you can walk away with your vault at any time. Both are legitimate. Read-the-code suits some users; verify-the-architecture-and-keep-your-export suits others.

Where Aegis wins

Aegis is not a budget alternative or a stepping stone. It is the right answer for a real and well-defined audience, and it earns the recommendation a lot of writeups give it.

FOSS, GPL-3.0, public source tree. This is the piece that is not negotiable for many of its users. Anyone can read the code, verify what the app does with their secrets, and confirm there is no telemetry, analytics SDK, or surprise network call. For users who want an authenticator that is inspectable rather than accepted on trust, Aegis is the right architecture.

Best-in-class defaults you can verify. Argon2id for key derivation, AES-256-GCM for the cipher, and a vault format documented in the repository. The primitives are not unique (Fob uses the same), but Aegis is unusual in that you can confirm the implementation matches the documentation by reading the source. That feedback loop closes a kind of trust gap in a way a closed-source app cannot fully match, and it is a real advantage of the FOSS model.

Zero account, ever. Local-first by design. Aegis does not have a sign-up. There is no email field, no password reset link from a vendor, no recovery email. You set a vault password, the app encrypts the database with it, and you are the only entity in the loop. For users who specifically do not want any third-party identity in their 2FA story, this is the point.

No commercial pressure on the design. No Premium tier, no upsell, no growth team. Maintainers ship what makes the app better and refuse what does not. That is a real benefit when you are evaluating long-term software you want to depend on.

Fast, minimal, and battle-tested. The app opens fast, generates codes fast, and the UI does not bloat from one release to the next. It has been the default recommendation in Android privacy circles for years; the user base is sophisticated, the bug reports are technical, and the project's track record of responding to them is strong.

Where Fob wins

Fob exists because there is a class of authenticator user that Aegis does not serve, by design.

iOS is on the roadmap. Fob is Android-first; iOS comes after. Aegis is Android-only by design and is not building iOS. If you carry an iPhone, want to move to one, or have a partner who needs the same set of codes on iOS, Aegis cannot solve it. That is the single most common reason a current Aegis user looks at Fob.

Multi-tag organization. This is Fob's core differentiator and no major competitor has it. Each account can carry multiple tags: a Coinbase account can be crypto, exchange, and high-value simultaneously. The filter UI is one tap. Aegis supports a single group per entry, which works at 20 accounts and breaks down at 60. For a vault that has accumulated through years of signups, multi-tag is the difference between a navigable structure and a wall of icons.

Managed end-to-end encrypted cloud backup. Aegis encrypts a local backup file and lets you sync it however you want (Drive, Nextcloud, Syncthing, an SD card). Fine if you already run that infrastructure. For users who do not want to own the backup stack themselves, Fob handles it: vault encrypted on-device with your password as the root, server holds an encrypted blob, decryption happens only on a device you own. Same end state as Aegis-plus-Nextcloud, without the Nextcloud.

Family and shared accounts on the roadmap. Aegis has no shared-account model and is not planning one. Fob's family sharing is post-MVP, with the same zero-knowledge architecture. If you need to cover a partner's accounts or a small family without scanning the same QR into multiple phones, Aegis cannot help and Fob is being designed for it.

Trust by verifiable architecture, with one vendor accountable end to end. Different from source-code visibility, not better or worse. Fob's encryption is verifiable from how the app behaves: codes are generated on-device, the server only ever holds a blob it cannot decrypt, and the full design is documented at fob.codes/security. The same architecture covers the cloud backup layer as well as the local vault, and export-always means you can leave with your whole vault at any time. For users who would rather have one vendor on the hook for the whole stack than a patchwork of authenticator-plus-third-party-sync, and are satisfied verifying the architecture rather than reading the source, this is the trust model that fits.

Where it depends

A few decisions are not "Aegis wins" or "Fob wins." They are real tradeoffs that come down to your situation.

iOS today or in the future. Aegis is Android-only, permanently. That is a hard fork in the decision tree. If iOS is in your life or you suspect it will be, Aegis is not the answer. If you are confidently Android-only for the long term, Aegis removes a constraint Fob does not.

Backup expectations: managed or DIY. Aegis with Nextcloud or Syncthing is fine for users who already operate that infrastructure. Fob's managed backup is fine for users who do not. The question is whether you treat off-device backup as a feature you outsource or a workflow you own.

Trust posture: read the code, or verify the architecture. Aegis offers a source tree you can audit yourself or trust the community to have audited. Fob offers a documented architecture you can verify from how the app behaves, and export-always so you are never locked in. Both are legitimate. The right one depends on whether you have the time and skill to evaluate code, or would rather rely on a design whose properties you can confirm without reading it.

Project sustainability: community or commercial. Aegis is sustained by maintainers with no revenue model. Fob is a commercial product backed by Cleargate Labs LLC with a Premium tier. Different risks: a community project can lose its maintainer; a commercial project can change pricing. Pick the failure mode you tolerate better.

The decision framework

A short test that resolves most cases.

1. Is Android-only acceptable, indefinitely?
If yes, Aegis stays in the running. If no, Aegis is out and Fob is the move. This is the question that filters fastest.

2. How important is FOSS specifically?
If reading the source (or knowing other people can) is the dominant requirement, Aegis is the right pick. If verifiable architecture and export-always are acceptable in place of source visibility, Fob is on the table.

3. Where do you want the backup destination to live?
If you already run sync infrastructure you trust, Aegis on top of it is great. If you would rather one vendor own off-device backup end to end, Fob is the fit.

4. How many accounts do you have, and do they cluster?
Below 30, Aegis's single-group filter is fine. Above 50, you want multi-tag, and Fob is the only major option that has it.

If three of the four answers point to Aegis, stay on Aegis. If two or more point to Fob, Fob is the move. The migration in either direction is short and reversible; there is no wrong commitment here.

Migration paths

If you decided Fob is the better fit for your situation, the step-by-step is at /import/aegis. It takes about five minutes and uses Aegis's encrypted JSON export. Your Aegis vault stays intact on the original device until you choose to remove it.

If you are weighing Fob against the broader landscape, see also /compare/fob-vs-google-authenticator, /compare/fob-vs-authy, and /compare/fob-vs-2fas. The 2FAS comparison covers a similar FOSS-versus-verifiable-architecture question with cross-platform thrown in; the Authy comparison is where we recommend leaving Authy for almost everyone.

What to do next

If Aegis fits your profile (Android-only, FOSS-priority, comfortable owning your sync layer, accounts that fit a single-group filter), stay on it. It is a good app and we do not need every Aegis user to switch. The honest answer for that audience is that Aegis does the job and does it well.

If you want what Fob is building (iOS coming after Android, multi-tag organization, managed end-to-end encrypted cloud backup, and trust by verifiable architecture with export-always), get it on Google Play. iOS comes after Android; get notified from the homepage when it lands. The architecture is at fob.codes/security.

Questions this comparison did not answer? Email us at hello@fob.codes.