Authy
Winter 2012AcquiredAuthy is a Two-Factor Authentication platform for developers
Pressure-test this opportunity
Turn this teardown into a decision-ready prompt for ChatGPT, Claude, or your agent.
Authy is a Two-Factor Authentication platform for developers
Turn this teardown into a decision-ready prompt for ChatGPT, Claude, or your agent.
If you only have a few minutes to spare, here’s what investors, operators, and founders should know about Authy (W12).
Authy made two-factor authentication easier for developers and less fragile for users. Founded by Daniel Palacio in 2011 and launched through Y Combinator's Winter 2012 batch, it combined an API for relying websites with an encrypted, synchronized authenticator app.[1]
This is an acquisition story, not a shutdown. Twilio bought Authy for $6.1 million in 2015 after roughly 6,000 sites had adopted it.[2] Authy's distribution and recovery design solved real problems, but its phone-number identity model also concentrated risk. Later breaches and endpoint exposure showed the tension between convenient recovery and a centralized attack surface.
Palacio came to authentication through security work. He had been a penetration tester and had worked on Microsoft's Windows security team before starting Authy. TechCrunch reported that he was tired of internet services relying on passwords alone.[3]
Authy's initial insight was practical: two-factor authentication failed when every service had to build enrollment, delivery, recovery, and fraud controls itself. The company offered those mechanics through a developer API, while its app generated time-based codes offline and encrypted backups behind a password Authy did not store.[4]
The observed research contains only one fetched founder quotation and does not preserve its exact wording. A second founder interview or transcript was not found. Rather than inventing dialogue, this report records the gap. The evidence still shows a consistent founder thesis: remove the engineering work that kept stronger authentication out of ordinary products.
Authy joined two products that competitors often separated. Developers integrated an API to enroll users and challenge logins by SMS or app-generated token. Consumers installed one authenticator that could retain encrypted TOTP seeds, work offline, back up accounts, and synchronize them across devices.[4]
The phone number became the bridge. It gave developers a familiar identifier and gave users a path to move tokens to a new device. Twilio later added QR enrollment that kept phone and email data from the relying website, an attempt to preserve convenience while reducing disclosure.[10]
That architecture differentiated Authy from single-device code generators. It also meant recovery could become an authentication event with high consequences. Authy had to secure app access, device registration, encrypted backups, phone-number changes, and the service endpoints connecting them.
Authy initially sold to developers who wanted two-factor authentication without building carrier delivery and token infrastructure. By 2014 it had hired an identity executive to pursue enterprise accounts. Coinbase, MercadoLibre, and Cloudflare were among roughly 6,000 sites using Authy when Twilio acquired it.[11]
The observed sources do not establish a reliable market-size figure. Adoption is clearer than revenue: thousands of sites integrated Authy within four years, proving demand for an outsourced authentication layer. Contract values, retention, gross margins, and consumer usage were not disclosed.
Authy competed with authenticator apps, SMS providers, enterprise identity vendors, and internal security teams. Its advantage was integration speed plus consumer recovery. Twilio said Authy cut an authentication integration from months to days, matching Twilio's API-first developer strategy.[12]
Read the complete post-mortem, the rebuild playbook, and the exact reasons Authy is still worth studying now.