Which authenticator app to use
Every standard authenticator app works with Paramant. An app that supports SHA-256 gives you the strongest setup.
Why we recommend SHA-256
The Paramant relay (our server) accepts TOTP codes made with SHA-256 and with SHA-1, so every standard authenticator app works. We recommend SHA-256 because it keeps the sign-in step on the same cryptographic standard as the rest of the transfer, which is built around post-quantum key exchange and FIPS 203 primitives. HMAC-SHA1 is not broken and RFC 6238 uses it as the default, so a SHA-1 app is safe to use. SHA-256 is the stronger, more consistent choice.
Recommended apps (SHA-256)
Authy, 1Password, Aegis (Android, open source), Raivo (iOS, open source), Bitwarden, Ente Auth (iOS and Android, open source), and 2FAS all support SHA-256 TOTP. Each of them reads the QR code on the setup page and gives you the strongest setup.
Not sure which to pick? Aegis on Android and Raivo on iOS are open source, store codes locally, and have no cloud dependency. 1Password and Bitwarden are good choices if you already use a password manager.
Also works (SHA-1)
Google Authenticator, Microsoft Authenticator, and the authenticator built into iCloud Keychain use SHA-1 TOTP. Paramant accepts SHA-1 codes, so these apps work fine. For the strongest setup we still recommend one of the SHA-256 apps above.
Already using Google Authenticator? It keeps working. Switching to a SHA-256 app such as Raivo or Aegis is a small upgrade, not a requirement.
Switching to a SHA-256 app
Google Authenticator works with Paramant. For the strongest setup you can keep it for your other services and add a SHA-256 app (Aegis on Android, Raivo on iOS) specifically for Paramant. You can have more than one authenticator app on the same phone.