Best 2FA and authenticator apps for Canadian small businesses

A Smithville shop does not need a hardware-key RFP. It needs a second factor that still works when the phone dies, and an honest line between a free authenticator and a paid vault. US “best 2FA app 2026” lists skip the part that locks you out: seed backup, SMS versus TOTP, and the fact that Authy’s desktop app is already gone.

This comparison is five paths shops actually open: Microsoft Authenticator (free; same-OS backup), Google Authenticator (free; Google Account sync), Authy (free; desktop EOL), 1Password TOTP and Watchtower (CAD or USD vault), and Apple passkeys / iCloud+ Keychain (not a TOTP app). Authenticator and 2FA prices checked against public vendor pages, 6 September 2026.

Who this page is for

• A Canadian sole prop turning on 2FA for CRA My Business, the host, and the ledger — and wondering which free app will survive a new iPhone.
• A shop already on 1Password who was about to install a second authenticator for the same logins.
• Anyone still using SMS codes for the Microsoft 365 or Workspace admin.
• Not a hands-on lab. Not a SIM-swap test. Not a hardware security-key bake-off.

Snapshot (public pages, 6 September 2026)

Sources: Microsoft Authenticator backup; transfer to a new phone; Google Authenticator; Authy cost; Authy desktop EOL; 1Password one-time passwords; Watchtower; Apple passkeys (CA); passkey security.

Microsoft Authenticator — free, same-OS backup, work accounts need a sign-in

Official Microsoft Authenticator is a free mobile app. No CAD or USD subscription card. Work/school push may ride a Microsoft 365 / Entra seat you already pay — that is not an Authenticator SKU. Source: Microsoft Authenticator.

Official Microsoft Support “Back up your accounts”: backup and restore only on the same device type — an iOS backup cannot be restored on Android. Android cloud backup stores to a personal Microsoft account. iOS backup uses iCloud Drive, Keychain, and Backup with Authenticator toggled on. Official Learn transfer guide: keep the old phone until sign-in works on the new one. Source: Back up your accounts.

Official Learn “Transfer Microsoft Authenticator to a new phone”: third-party TOTP accounts (Amazon, Facebook, Gmail, etc.) restore the 30-second codes. Work or school accounts restore only the account name — you must sign in again. Personal Microsoft accounts that are passwordless also need a fresh sign-in. Authenticator passkeys are device-bound and are not in that backup; add a new passkey on the new phone before you retire the old one. Official passkey FAQ: Authenticator passkeys are only device-bound and cannot be synced. Sources: https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-transfer-authenticator-new-phone; https://learn.microsoft.com/en-us/entra/identity/authentication/passkey-authenticator-faq.

Use it if the shop already lives in Microsoft 365. Turn Cloud Backup on before you buy a new phone. Do not factory-reset the old handset until work accounts and passkeys work on the new one. Opening that admin on café Wi-Fi is still a VPN problem.

Google Authenticator — free, and the Google Account is the backup

Official Google Account Help: the Google Authenticator app generates one-time codes for sites that support Authenticator 2-Step Verification. Free. No CAD or USD subscription card. Codes work without an internet connection or mobile service. Official same article: sign in to a Google Account and codes synchronize across devices. Google encrypts Authenticator codes in transit and at rest. You can instead tap “Use without an account” — codes then live only on that device and will not appear on other devices. Signing in on a new device syncs automatically; without an account you export/import via QR from the old phone. Official: if codes are not synced and the phone is gone, you must visit every site to remove and relink. Deleting the Authenticator service from the Google Account deletes synced codes on every device. Official also points at passkeys and extra 2-Step Verification methods so you are not locked out. Source: Get verification codes with Google Authenticator.

Stay here if the shop already lives in a Google Account or Workspace. Sign in so codes survive a new phone. “Use without an account” is a choice — official help says you then lose the multi-device protection. Prefer a passkey on the Google Account so Authenticator is not the only recovery path.

Authy — free, backups if you turned them on, no desktop

Official Twilio Help “How Much Does Authy Cost?”: for end users securing internet logins, Authy is free to install and use. No CAD or USD consumer SKU. Source: How much does Authy cost?.

Official Twilio changelog and Help EOL guide: Authy Desktop for Windows, macOS, and Linux reached end-of-life on 19 March 2024 and is no longer supported. Twilio recommends the mobile apps. Official note: Authy lacks an export feature — move by re-enabling 2FA on each site. Official alternatives list includes 1Password one-time passwords. Sources: https://help.twilio.com/articles/22771146070299-End-user-guide-End-of-Life-EOL-for-Twilio-Authy-Desktop-app; https://www.twilio.com/en-us/changelog/end-of-life--eol--of-twilio-authy-desktop-apps.

Official EOL guide: if Backups is enabled in Authy Settings, tokens sync between your Authy devices. That is a cloud backup of seeds behind a backup password — not a printed recovery-sheet export. Confirm Backups is on before you replace the phone. Official Twilio also lists 1Password as a desktop TOTP alternative. That is the honest move if you wanted Authy on a PC.

Use Authy if you already have tokens there and Backups is on. Do not start a new shop on Authy because a 2022 blog praised the desktop app. Do not invent an export tool.

1Password TOTP and Watchtower — the paid vault, not a second app

Official 1Password Support “Use 1Password as an authenticator” (published 17 August 2026): save a one-time password on the Login item (scan QR or paste the secret). The browser extension and apps can autofill the code with the password. You can share logins that include one-time passwords via shared vaults. Source: Use 1Password as an authenticator.

Official 1Password Support “Watchtower” (published 17 August 2026): Watchtower is a dashboard for breaches, weak and reused passwords, and sites that support two-factor authentication but do not yet have a one-time password saved. “Passkeys available” is a separate Watchtower row. Watchtower is not a second authenticator app — the TOTP secret lives on the Login. Source: Watchtower.

1password.com/pricing/personal and /pricing/business have a CAD / USD / EUR toggle. CAD figures below are from the official CAD CMS fields retrieved 6 September 2026. Confirm the selector at checkout. Individual CAD $3.56/month billed annually (CMS field “PWM Pricing - Individual CAD”). Confirm at checkout whether that is the first-year promo or the regular CAD line.. Teams Starter Pack CAD $29.95/month billed annually (CAD $359.40/year). Extra seats CAD $6.25/seat/month.. Business CAD $10.99/user/month billed annually; CAD $12.99/user/month on monthly billing (teams page JSON) 4711 Yonge St, 10th Floor, Toronto, Ontario, M2N 6K8, Canada (printed on 1password.com/pricing/personal and 1password.com/company) Sources: https://1password.com/pricing/personal; https://1password.com/pricing/business.

Put TOTP in 1Password when the shop already pays for the vault and you want the code next to the password — including a shared bookkeeper vault. That is the password managers page doing 2FA, not a reason to run three authenticator apps. Watchtower’s “two-factor authentication” row is a to-do list, not a second factor.

Apple passkeys and iCloud Keychain — honest, and not TOTP

Official Apple Support (CA) “Use passkeys… on iPhone”: passkeys replace passwords on supported sites and apps. They sync on devices signed into the same Apple Account. To use passkeys, iCloud Keychain and two-factor authentication must be on. Passkeys are encrypted and stored in iCloud Keychain, where they aren’t visible to anyone (including Apple). Source: Use passkeys on iPhone (CA).

Official Apple Support (CA) “About the security of passkeys”: passkeys sync with iCloud Keychain. iCloud Keychain is end-to-end encrypted with keys not known to Apple, and is recoverable if the user loses all devices (escrow, rate-limited). Official iCloud Keychain security overview: passwords and passkeys sync across iPhone, iPad, Mac, Apple Watch, and Apple Vision Pro without exposing them to Apple. Sources: https://support.apple.com/en-ca/102195; https://support.apple.com/en-ca/guide/security/sec1c89c6f3b/web.

A passkey is not a TOTP code. Sites that only offer an authenticator app still need Microsoft / Google Authenticator, Authy, or 1Password TOTP. iCloud+ on apple.com/ca is storage (photos, backup) — not a 2FA subscription. Confirm CAD at Apple checkout if you buy iCloud+ for space. iCloud+ on the Canada page: $1.29/month for 50 GB; $3.99/month for 200 GB; $12.99/month for 2 TB; $39.99/month for 6 TB; $79.99/month for 12 TB. Every paid plan includes Private Relay, Hide My Email, custom email domain, Apple Invites, and Family Sharing with up to five other people. apple.com/ca/icloud/ printed those dollar cards without a USD/CAD label. Confirm CAD at Apple checkout. Do not invent a USD conversion. iCloud Drive is the Apple photos / backup / Files layer. Family Sharing is not a client file portal. Private Relay is not the shop VPN page. Keychain is not the shop password-manager page. Source: https://www.apple.com/ca/icloud/.

Use passkeys on Apple-only devices for sites that offer them. Keep Microsoft or Google Authenticator (or 1Password TOTP) for the host and the ledger that still show a QR code. Family Sharing is not a shop admin console — that honesty already lives on the vault page.

When free authenticators are enough

• You need TOTP on a handful of sites. Microsoft or Google Authenticator is $0. Turn backup or Google Account sync on.
• You are not paying for 2FA. You may already pay 1Password for the vault — add the one-time password there instead of a second app.
• Apple passkeys cover the sites that support them. QR-only sites still need an authenticator.
• SMS is what the site offered in 2019. If it now offers an app or a passkey, switch. Keep the printed backup codes.

Move the TOTP into 1Password when you share the HostPapa login with a bookkeeper and you do not want the code only on one person’s phone. That is a vault decision, not an Authenticator upgrade.

A practical pick

1. Already on 1Password: save TOTP on the Login. Use Watchtower to find sites still missing a one-time password. Details: password managers for Canadian small businesses.
2. Microsoft 365 shop, one phone: Microsoft Authenticator. Enable backup. Re-register work accounts and passkeys on a new handset.
3. Google / Workspace shop: Google Authenticator signed into the Google Account. Prefer a passkey on that account too.
4. Apple-only household: iCloud Keychain passkeys, plus one TOTP app for QR-only sites. Do not buy iCloud+ for 2FA.
5. The malware scan is still antivirus. The café hop is still a VPN. Neither replaces the second factor.