I've read around the Authy site and done a few Google searches, but it is not clear to me whether an attacker that compromised my Authy account backup password could access my keys without any additional data.

For example, when I setup Authy app, I choose a password of "B4dpassw0rd", and I chose to backup my keys. If an attacker guesses my bad password, will they be able to retrieve my encrypted keys and decrypt them?

The reason I hope that this is not the case, is that when I installed the app on my phone, I registered it with a phone number and received a 2FA token via SMS. So, it seems there is some device/account verification in place, but this may or may not be a part of the data used to encrypt my backup.

  • Better ask their customer support. Most token type second factors are verify-only so they cannot directly contribute to the static security of data.
    – billc.cn
    Aug 22, 2016 at 14:30

2 Answers 2


I'm a Solutions Architect with Authy and am happy to clarify this issue for you.

As you noted, we do require a password to encrypt and store your 'backup keys'.

We also have an opt-in feature which allows for the syncing of these keys across multiple devices (iPhone, Android, Chrome Extension). When you add a second device, you need to provide the first phone number to get access to those keys. At this point, you can choose either an SMS/Voice or "Use Existing Device" (your initial phone) notification for accessing your Authy account.

If you choose SMS or Voice, your initially registered phone number will get a notification with a token to gain access to the Authy account.
Adding via SMS

If you choose to 'Use Existing Device', you'll receive the following prompt on your initially registered device as seen here:

Approved or Deny new device

Once you've added a device, you can always see (and remove) devices that are associated with your account from any device.

To answer your question, before an attacker can sync keys down to an additional device, they will have to have approved the addition of another device via a token or the "Use Existing Device" feature on your initially registered device. If they are able to provide this approval, then they already have access to your primary phone... which is not ideal.

I hope this clears everything up for you.

Cheers! - Josh @ Authy

tl;dr Even with your password, this attack vector still requires user-approval from your initially registered phone number.

stl;dr Your Authy ID is tightly coupled with the phone number initially used during registration. Having the "B4dpassw0rd" will not help the attacker.

  • 4
    tl;dr Even with your password, this attack vector still requires user-approval from your initially registered phone number. or human factors at Authy (social engineering of phone change)? support.authy.com/hc/en-us/articles/…
    – ptomli
    Dec 6, 2017 at 9:17
  • You should address what happens if a mobile network provider reissues your phone number or if the setup SMS gets intercepted. In the past both scenarios have lead to exploits, so it’d be appropriate to extend this answer. @TheMessenger’s answer below is better IMO as it highlights these risks.
    – gen
    Mar 24, 2020 at 18:16
  • That's fine if your systems are all enforcing the process. The real question is ... "How much of that is backed by technical limitations"? Eg could an Authy employee access the backup file? If so, all they'd need is your password and the whole "device auth" workflow could be bypassed. Ultimately, it appears authy holds the encryption keys? And thus the only real guarantee is "authy wouldn't intentionally do that"?
    – Basic
    Apr 12, 2021 at 8:52

Without requiring any access to a user's phone, a hacker could use the SMS/Voice option & exploit the vulnerabilities documented in the Signaling System 7 (SS7) protocol to intercept a token. They could also use an IMSI catcher to eavesdrop on tokens in transit. This isn't unique to Authy, since no 2FA system that relies on SMS has mechanisms to prevent this.

  • 1
    This 2FA via SMS shortcoming has just come to light this week (02AUG2018) after Reddit disclosed that they were hacked using user accounts where SMS codes were intercepted. krebsonsecurity.com/2018/08/… Aug 2, 2018 at 15:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .