2FA Authenticator App - MFA

Get the app

2FA Authenticator App - MFA for iPhone and iPad is distributed through the App Store, and for Android through Google Play.

MxT APP is the studio name of Truong Mai, the developer of 2FA Authenticator App - MFA on the App Store and Google Play. On your phone or tablet, the app is shown as Authenticator App.

Getting started

1. Open the app. You can create a 6-digit app PIN and turn on Face ID or Touch ID, or skip this and do it later in Settings › App password.
2. On a computer or another device, sign in to the website or service you want to protect and open its security or two-step verification settings. Choose to set up an authenticator app.
3. In the app, tap Add new on the Accounts tab and scan the QR code the service shows. You can also pick a QR code image from Photos or Files, or type the setup key by hand.
4. Type the code shown in the app into the service to finish. From now on, the service asks for a fresh code from the app when you sign in.

Not sure where a service keeps its 2FA settings? Open Settings › How to use in the app for step-by-step guides for many popular services and answers to common questions.

What you can do

2FA codes

• Time-based one-time passwords (TOTP, RFC 6238) with SHA1, SHA256 or SHA512, 6 to 8 digits and the refresh period the service sets.
• Add accounts by scanning a QR code with the camera, from a photo or image file, or by entering the setup key manually.
• Import accounts exported from Google Authenticator by scanning its transfer QR codes.
• Save each account's backup (recovery) codes together with it.
• Search, reorder and organize accounts in folders.
• Tap a code to copy it. Copied codes stay on this device (they are not shared through Universal Clipboard) and are cleared from the clipboard after 30 seconds by default; change this or turn it off in Settings › App password.
• Counter-based codes (HOTP) are not supported.

Passwords

• Save logins with the service name, website, username, password and notes.
• Create strong passwords with the built-in password generator. Copied passwords are cleared from the clipboard after 60 seconds by default.
• The Password risks card on the Passwords tab flags passwords that are weak, very common or used for more than one entry. This check runs entirely on your device; the app does not look up your passwords in online breach databases. You can turn off Automatic security scan on the Password risks screen.

Private browser

• Open a service's website inside the app, for example to turn on 2FA, without saving history, cookies or site data. Everything is erased when you close a tab or the app.
• Cross-site cookies are blocked. Searches you type in the address bar are sent to Google Search.
• Bookmarks you save are kept only on your device. Files cannot be downloaded in private browsing; you can open them in your default browser instead.
• Websites cannot use your camera, microphone or location.

App lock

• Protect the app with a 6-digit PIN and, if you like, Face ID or Touch ID. When a PIN is set, the app locks every time you leave it, and its contents are blurred in the app switcher.
• When a PIN is set, exporting accounts, exporting a backup file or turning off the PIN asks for your PIN again.

App updates

• The app checks the App Store for a newer version. When one is available, it shows an Update available message with the release notes. You can update right away or choose Not now and keep using the app.

Backup, sync & moving phones

• iCloud Sync & Backup (optional) — turn it on in Settings › Backup & sync to keep the same vault on your iPhone and iPad signed in to the same Apple Account. The vault is stored in your own private iCloud database and its contents are end-to-end encrypted by iCloud.
• Encrypted backup file — export every account and password to a file protected by a passphrase you choose (AES-256-GCM, key derived with PBKDF2-SHA256). Without the passphrase the file cannot be opened or recovered, so keep it safe.
• Move accounts to another authenticator app — choose accounts and export them as transfer QR codes, as an image or as a CSV file. Images and CSV files are not encrypted and contain your setup keys; delete them after use.

Troubleshooting

A code is not accepted

Codes depend on the time. Turn on Settings › General › Date & Time › Set Automatically on your iPhone or iPad, check that you picked the right account, and type the code before its ring runs out. If it still fails, remove the account and add it again from the service's security settings.

The camera does not scan the QR code

Allow camera access in Settings › Privacy & Security › Camera. You can also take a screenshot of the QR code and choose it from Photos, or type the setup key the service shows under the QR code.

iCloud sync is not working

Make sure you are signed in to iCloud on each device with the same Apple Account, that iCloud has free space, and that the devices are online. Sync status and any error are shown in Settings › Backup & sync.

I forgot my PIN

If Face ID or Touch ID is on, unlock with it and change the PIN in Settings › App password. Otherwise the PIN cannot be recovered, because it is never stored in readable form: choose Forgot PIN? › Start Over, then restore your encrypted backup file, or turn on iCloud Sync & Backup again to bring back the copy in iCloud.

I got a new phone

If iCloud Sync & Backup was on, sign in to the same Apple Account and turn it on again on the new phone. Otherwise restore your encrypted backup file in Settings › Backup & sync. Without a backup, use the recovery codes each service gave you when you turned on 2FA.

On Android

The Android app works the same way, with these differences:

• App lock uses your PIN and, if you like, fingerprint or face unlock.
• No iCloud Sync & Backup. Use an encrypted backup file in Settings › Backup & sync to keep a copy and to move to a new phone. The vault is not copied by Android's own backup or phone-to-phone transfer, because its key never leaves the device.
• Codes not accepted? In your phone's settings, open Date & time and turn on automatic date and time.
• Camera — allow it in your phone's settings under Apps › Authenticator App › Permissions.
• QR scanning uses Google ML Kit on your device. ML Kit sends Google diagnostic data about the scanner (never your codes or passwords); see section 10 of the Privacy Policy.
• App updates come from Google Play; the app does not check for updates itself.

App privacy

2FA Authenticator App - MFA does not collect, store or share personal data on our servers. It has no analytics or tracking of ours. On iPhone and iPad no data is collected at all; on Android, Google's ML Kit QR scanner sends Google diagnostic data about the scanner itself.

• Your vault — stored on your device. Setup keys, backup codes and the website, username, password and notes of each login are encrypted. Your data leaves the device only if you turn on iCloud Sync & Backup or export it yourself.
• Camera and photos — used only to read the QR codes you scan or choose. Images are processed on your device and never uploaded.
• Face ID / Touch ID, fingerprint or face unlock — handled by the operating system; the app only receives a yes or no answer.
• Location — not used by the app, and websites in the private browser cannot access it.
• Network — on iPhone and iPad the app contacts Apple's App Store to check for a newer version; on Android, Google's ML Kit sends scanner diagnostics to Google; and the private browser connects to the websites you open.
• Support email — if you tap Contact us, your mail app opens with your device model, iOS or Android version, app version and language filled in; you choose whether to send it.

Read the full 2FA Authenticator App - MFA Privacy Policy and Terms of Use.

Contact support

Questions, bug reports or feature ideas are welcome. Please include your device model, iOS or Android version and what you tried. Never send us your setup keys, codes or passwords.

MxT APP (Truong Mai)
Email: maixuantruongcvdev@gmail.com
We read every message and reply as soon as we can.

Service names and logos shown in the app are used only to help you recognize your accounts and belong to their owners. MxT APP is not affiliated with or endorsed by them. iPhone, iPad, iCloud, Face ID and Touch ID are trademarks of Apple Inc. Google Authenticator and Google Search are trademarks of Google LLC.