What two-factor and aliases are
A password is something you know, and once it leaks, anyone can use it. Two-factor authentication (2FA) adds something you have, usually your phone, so a stolen password on its own isn’t enough. When you sign in, the site asks for a six-digit code from an app on your phone, and the code changes every 30 seconds or so.
The codes come from a secret that the site and your app share. When you turn on 2FA, the site shows a QR code. Your app scans it, and from then on both sides can work out the same code from that secret and the current time. Nothing is sent to your phone, so it works with no signal.
An email alias solves a different problem. Instead of giving every shop your real address, you give each one its own forwarding address. Mail still arrives in your normal inbox. If one address starts getting spam or turns up in a data leak, you switch it off, and you know exactly who let it out. Aliases also stop one email address tying all your accounts together.
Which kind of second step
Not every second step is equally strong. From weakest to strongest:
| Method | How it works | The weak spot |
|---|---|---|
| Text message codes | The site texts you a code | Someone who takes over your phone number gets the codes too |
| Authenticator app | An app on your phone makes the code | A convincing fake site can ask for the code and use it straight away |
| Passkey or security key | Your device proves who you are to the real site only | Not every site offers it yet, and you need a backup |
Use the strongest each site offers. For most sites today that’s an authenticator app, which is where Ente Auth comes in.
What it needs
- Your phone and about an hour to turn on 2FA for the accounts that matter: email first, because it can reset everything else, then your password manager, bank, Apple or Google account and social media.
- Somewhere safe on paper for backup codes and Ente’s recovery key.
- For aliases, a free account with a forwarding service. Free plans have limits, covered in the list below.
How Ente Auth fits in
- Every device. Apps for iPhone, Android, Mac, Windows and Linux, and a web page where you can look up a code.
- Encrypted backup and sync. With a free Ente account, your codes are encrypted on your device before they’re uploaded, so Ente can’t read them, and a new phone gets them all back when you sign in.
- No account, if you prefer. Choose Use without backups and the codes stay on that device only. Then make an encrypted export now and then.
- Bulk import. Brings codes across from Google Authenticator, Aegis, 2FAS, Bitwarden, Proton and others.
- Easy to find your way around. Icons, tags, notes and search keep fifty codes manageable, and it shows the next code before the current one runs out.
- Open source and reviewed. The code is public, and Ente’s encryption has been checked by outside security firms.
The easy way to set it up
Everything happens in the app and in each website’s settings.
- Install Ente Auth from the App Store, the Play Store or ente.com.
- Create an account and choose a strong password. Store it in your password manager.
- Save the recovery key. Ente gives you 24 words. Write them on paper and keep them with your other important papers. Ente can’t reset your password, so these words are the only way back in. You can view them again later under Settings, Account, Recovery key.
- Move existing codes across. If you already use another app, export from it and use Import codes in Ente’s settings. Keep the old app until you’ve checked that every code works.
- Add 2FA to an account. In the site’s security settings, look for two-step verification or two-factor authentication, choose the authenticator app option, and scan the QR code with Ente. Type in the code Ente shows to finish.
- Save the backup codes. Most sites then give you a handful of one-time codes for when your phone is lost. Print them or write them down.
Repeat steps 5 and 6 for each important account. Where a site offers a passkey, consider that instead.
For email aliases:
- Make an account with an alias service from the list below, and add its browser extension.
- At a sign-up form, click the extension’s icon to make a new alias on the spot.
- Or let your password manager do it. Bitwarden’s generator can create an alias at SimpleLogin, addy.io, Firefox Relay and others at the same moment it makes the password.
Questions people ask
What if I lose my phone?
With an Ente account, install Ente Auth on the new phone and sign in, and your codes come back. Without an account, you need your export file or each site’s backup codes. That’s why both matter.
Should my codes live in my password manager instead?
Some password managers can hold them, including Bitwarden on its paid plan. It’s convenient, but anyone who gets into the password manager then has both halves. A separate app keeps them apart. Either is far better than no 2FA at all.
Is a text message code better than nothing?
Yes. Use it where it’s the only choice, and switch to an app wherever one is offered.
Can I reply to emails from an alias?
SimpleLogin’s free plan lets you reply from an alias, so your real address stays hidden. Some other services keep replies for their paid plans, so check before you choose.
Will sites refuse alias addresses?
Occasionally a site blocks addresses from well-known alias services. Use your real address for that site, or an alias on a domain of your own.
