What happened to Authy desktop?
Twilio ended the Authy apps for Windows, macOS and Linux on 19 March 2024. Authy now runs on phones only, so every sign-in means reaching for your phone again.
Tick is a free two-factor authenticator that runs in your browser, on any computer. It makes the same standard codes (TOTP) every site’s “authenticator app” option uses, offline, with nothing to install. Install it from the address bar if you want it in its own window.
Why your Authy codes can’t just be exported
Authy doesn’t let you export your accounts’ secret keys to another app. So moving to any other authenticator, Tick included, means setting up the authenticator again on each site. It takes about a minute per account, and you only do it once.
Move each account, step by step
- Open Tick at tick.metricdeck.app/app and create a master password.
- On the site (Google, GitHub, AWS and so on), open its security settings and find two-factor authentication. Choose to set up a new authenticator app, or turn the authenticator off and on again.
- In Tick, choose Add account and pick Screen: Tick reads the QR code straight off your screen. If the site shows only a setup key, use Key.
- Confirm by typing Tick’s code into the site, and save the new backup codes the site gives you.
- Keep Authy until every account is done, then remove the old entries.
Start with the accounts you sign in to most. Those are the ones where a phone in your hand costs the most time.
Authy and Tick, side by side
- On your computer: Tick runs in any modern browser; Authy no longer has a desktop app.
- Getting a code: in Tick, type a few letters and press Enter to copy it.
- Account: Tick has none: no phone number, no sign-up. Authy needs a phone number.
- Sync: Authy syncs through its cloud. Tick has no cloud: move your codes between browsers with an encrypted backup file.
- Leaving: Tick exports everything, encrypted or as plain links, so you’re never locked in.
- Code: Tick is open source under the MIT licence.
Keeping your codes safe
Tick encrypts your codes with AES-256-GCM under a key that only your master password unlocks. The encrypted vault stays in your browser, and Tick makes no requests to any server: there isn’t one. Read the code on GitHub.
The honest trade-off.
Two-factor is strongest when codes live on a different device from your passwords. If you keep both on your computer, use a strong master password and keep each site’s backup codes somewhere safe. There’s no password recovery, by design.
Coming from Google Authenticator instead?
That one is quicker: Google Authenticator can export every account in one QR code. See Google Authenticator on your PC or Mac.