Why your 2FA secrets should live on one phone, not every device you own

Every authenticator app has to answer one question: where do the secrets behind your codes live? Most now answer “everywhere you are signed in” — your phone, your tablet, your laptop, a browser extension. That is convenient. It is also a list of places an attacker can take them from. U2 Secured Authenticator answers differently: on one phone.

What is actually being synced

A TOTP code is generated from a shared secret — the string inside the QR code you scanned. Anyone holding that secret can generate your codes forever, on any device, without you noticing. It is not a code; it is a permanent copy of your second factor. Syncing an authenticator means placing that permanent copy on every device in the sync set.

Two ways synced secrets leak

Through the cloud account. If sync is not end-to-end encrypted, whoever controls the cloud account controls the secrets. In 2023, Retool attributed part of its breach to Google Authenticator’s cloud sync: one phished Google account exposed the 2FA codes as well. BleepingComputer Google committed to end-to-end encryption for that sync, but 2026 reports say it had not shipped. CyberInsider

Through any one of the devices. End-to-end encryption fixes the first problem and not this one: every synced device decrypts the secrets so it can show you codes. A laptop is a far softer target than a phone. In two months of 2025, Microsoft counted more than 394,000 Windows computers infected with the Lumma infostealer alone. Microsoft Each extra device holding your secrets is one more machine that has to stay clean.

How one phone changes that

• One copy in use. Your codes and linked apps live on a single phone. There is no desktop app or extension holding a second copy.
• A backup nobody else can open. Premium backup is encrypted on the phone — key derived with Argon2id, sealed with AES-256-GCM — before it is uploaded. We store ciphertext.
• Moving is a move, not a copy. Restoring onto a new phone retires the old one, which wipes its copy. Approvals stop reaching it immediately.
• A theft you can see. If someone else restores your account, your phone tells you the account moved and that someone has your password — instead of silently becoming one of two devices.

Push approvals follow the same rule: they go to the one active phone, need Face ID or a fingerprint, and ask you to pick the number on the sign-in screen — see why number matching matters.

Who should care

If you use 2FA for a handful of low-stakes accounts, sync is a reasonable trade. If your 2FA protects things people actively try to take — an exchange account, a company’s admin console, a newsroom’s email, a domain registrar — fewer copies is the better trade. See how the app works.