Short answer: choose Aegis if you use an Android phone and want your 2FA secrets in an encrypted vault, with backups you make yourself and no link to any account. Choose Bitwarden Authenticator if you need iOS, or if you already use Bitwarden and want the same codes in the authenticator app and in your vault. The difference that matters most is not a feature: Bitwarden documents that its app stores local codes in an unencrypted database on the device, while Aegis encrypts its vault.
Sources, all read on 16 October 2026: Bitwarden's help pages for Bitwarden Authenticator and for importing and exporting its data, Aegis's README on GitHub, and the source code of Aegis's plain text importer. For Aegis's encryption details, see our Aegis vault encryption guide, based on its published vault design.
At a glance
| Aegis | Bitwarden Authenticator | |
|---|---|---|
| Platforms | Android only | iOS 15+ and Android 9+ |
| Account needed | No | No; a Bitwarden account is optional |
| Where local codes live | An encrypted vault on the phone | A local unencrypted database on the device, per Bitwarden |
| Unlock | Password or biometrics | Biometric login available |
| Backups | Automatic vault backups to a location you choose | The device's cloud backup (iCloud, Google One), plus manual export |
| Export | Plain text or encrypted | .json or .csv |
| Sync with a password manager | None | Optional sync with a Bitwarden vault |
| Import from the other | Through its plain text importer (otpauth:// links) | Direct import of an unencrypted Aegis .json (Android only) |
Where the secrets are, and what protects them
A TOTP code is computed from a secret that anyone holding a copy can use. So the useful question is how many copies exist and what protects each one.
Aegis keeps one copy, encrypted, on the phone. The vault is encrypted and unlocked with your password or biometrics. A second copy only exists if you make one, through its automatic backups to a folder you choose.
Bitwarden Authenticator keeps local codes in a database the app does not encrypt. Bitwarden's help page says so in those terms: authentication keys and their metadata are stored in a local unencrypted database on your device, they are not synced to Bitwarden's servers, and a backup is made by the device's cloud backup system. The protection therefore comes from the phone itself (its lock screen and the operating system's storage protections) and from the security of your iCloud or Google account. You can add biometric login to the app. Codes you sync with a Bitwarden vault also live in that vault, which Bitwarden encrypts.
Neither model is reckless: a locked modern phone protects app data well. But if you want the secrets to stay encrypted even when the phone is unlocked or backed up to someone else's cloud, Aegis is the one built that way.
Where Bitwarden Authenticator wins
- It runs on iPhone. Aegis is Android only.
- It works with a Bitwarden vault. You can save a new code "here" or "to Bitwarden", and sync codes already stored in your vault so they appear in the app.
- Backups happen without you. Your phone's cloud backup covers the app, and a new phone restored from that backup gets the codes back.
- It imports from several apps, including Google Authenticator (via its transfer QR code), LastPass Authenticator, 2FAS, Raivo on iOS and Aegis on Android.
Where Aegis wins
- The vault is encrypted at rest, with a design documented publicly.
- No account, no sync, no cloud unless you put a backup there yourself.
- Encrypted exports. Aegis can export in plain text or encrypted; Bitwarden Authenticator's exports are .json or .csv files that contain the secrets.
Keys scattered on a table, each with its own tag: every TOTP secret is a key like these, and the question is whether the drawer they sit in is locked.
Moving from one to the other
From Aegis to Bitwarden Authenticator (Android): in Aegis, open Import & Export and export the vault unencrypted. In Bitwarden Authenticator, open Settings, Import, choose Aegis, and pick the file. Check a few codes against the services, then delete the export file: it holds every secret in clear.
From Bitwarden Authenticator to Aegis: in Bitwarden Authenticator, open Settings, Export, and choose .json or .csv. Each local code in the file carries an otpauth:// link. Copy those links into a plain text file, one per line, and use Aegis's Plain text importer, which reads otpauth:// links line by line. Codes synced from a Bitwarden vault are not in that export; Bitwarden says to export them from the vault separately. Delete every intermediate file once you are done.
★ Cure53 audit · ✓ Free plan · Cross-platform
An authenticator protects the second factor; the first one still has to be uniqueIf you do not use Bitwarden's password manager, a password manager such as NordPass generates and stores a different password for every account, including the one that protects your authenticator backups.→How to choose
- Android, and you want the secrets encrypted on the device: Aegis.
- iPhone: Bitwarden Authenticator, or another app from our guide to the best authenticator apps.
- You already live in Bitwarden and want one place for passwords and codes: Bitwarden Authenticator with vault sync, keeping the code for your Bitwarden account itself as a local code.
- Changing phones soon? Read our guide to moving an authenticator app to a new phone first.
- Comparing Aegis with other apps? See Aegis vs Authy and Aegis vs Google Authenticator.
Summary
Both apps produce the same standard TOTP codes. Aegis gives you an encrypted, account-free vault on one Android phone and leaves backups to you. Bitwarden Authenticator gives you iOS and Android, cloud backup through the phone, and optional sync with a Bitwarden vault, with local codes stored, by Bitwarden's own account, in an unencrypted database protected by the device.
★ Cure53 audit · ✓ Free plan · Cross-platform
A manager with built-in 2FA & passkeys → NordPassStore TOTP & passkeys · XChaCha20 · free tier→Frequently asked questions
Is Bitwarden Authenticator encrypted?
Not at the app level, according to Bitwarden. Its help page states that authentication keys and their metadata are stored in a local unencrypted database on the device, that this data is not synced to Bitwarden's servers, and that a backup is made by the device's cloud backup system such as iCloud or Google One. You can add biometric login to the app. Codes you choose to sync with a Bitwarden vault are also stored in that vault, which is encrypted.
Can I import Aegis codes into Bitwarden Authenticator?
Yes, on Android only. Bitwarden's import page lists Aegis among supported sources and asks for an unencrypted Aegis .json export, made from Aegis's Import & Export screen. Delete that export file once the import is done, since it contains every secret in clear.
Can I move from Bitwarden Authenticator to Aegis?
Yes. Aegis has no importer named after Bitwarden, but it has a plain text importer that reads otpauth:// links line by line, and Bitwarden Authenticator's export contains an otpauth:// link for every local code. Put those lines in a text file, import it in Aegis, check a few codes, then delete the file.
Which one should I use for my Bitwarden account's own 2FA?
If you use Bitwarden Authenticator, Bitwarden itself says to save that code as a local code so it does not sync into the vault it protects, which could lock you out. Aegis avoids the question entirely, since it never syncs with a password manager.
