Aegis Authenticator is a free, open-source, local-only 2FA (HOTP/TOTP) app for Android, maintained by Beem Development and published under GPLv3, available on Google Play and F-Droid. The project's own FAQ states plainly that the app has no internet access at all and that the maintainers have no plans to change this; F-Droid's independently generated permissions listing for the app corroborates this, showing only camera, biometric, boot-start, and vibration permissions, with no network/internet permission requested. The vault is encrypted locally with AES-256-GCM, unlockable by password (scrypt-derived) or device biometrics, and the project's own security-design document details its cryptographic choices in depth. No GitHub Security Advisory has been published for the project's repository, and no independent third-party security audit report could be located as a live, fetchable source at draft time — the app's small, informally organized maintainer team (no filed legal entity found) is disclosed only through its GitHub organization and F-Droid listing rather than a registered company page.
TIMELINE
1 ENTRY
[2026-08-30] · NEW RECEIPTS
7 new sources on file for Aegis Authenticator.
Aegis Authenticator's file gained 7 new sourced claims since its last review.
Aegis's own FAQ states the app does not have access to the internet at all, and that the maintainers have no plans to add such access, explaining why the app cannot support automatic cloud backups to arbitrary providers.
Aegis's README states the app supports exporting the vault (in plaintext or encrypted form) and configuring automatic backups to a storage location entirely of the user's own choosing, rather than a fixed operator-controlled destination.
F-Droid's listing for Aegis names the app's author as 'Beem Development' and states the app is licensed under the GNU General Public License v3.0 only, with links to the public source repository, issue tracker, and translation platform.
Aegis's published security-design document states the vault file is encrypted using AES-256 in GCM mode, an authenticated encryption cipher, and can be unlocked only with a password (run through the scrypt key-derivation function) or the device's biometric hardware, meaning the operator has no access to vault contents and the app has no server component to share them from.
GitHub's Security Advisories page for the beemdevelopment/Aegis repository states there are no published security advisories for the project, indicating no disclosed vulnerability history at draft time.
F-Droid's independently generated permissions listing for the Aegis APK shows only camera access (for scanning QR codes), boot-start, biometric/fingerprint hardware access, and vibration control — no INTERNET or network-access permission is listed among the app's declared permissions.
Aegis's README lists screen capture prevention among the app's security features, a local technical control against screenshot- or screen-recording-based leakage of 2FA codes, alongside its lack of any network permission.