"Pay before you can see the verification code": a UAE company that makes TV remote controls moved the same subscription funnel onto "Authenticator"
What it is A 2FA authenticator and password manager that adds accounts by QR scan and generates one-time codes, but you need a subscription (from $2.99/week) for it to work properly.
Why it's taking off When websites ask users to turn on two-step verification, people search "authenticator" in the app store. This company, which makes a subscription remote-control app, uses off-the-shelf paid acquisition accounts, a paywall, and brand-term ASO to catch that search traffic, switching budgets on and off in waves to pile up installs.
DHow to copy it: Skip the paywall-checker clones. Small teams with a subscription app and paid acquisition can copy the method instead: pick a generic utility keyword people search when they're in a hurry, test it in a small store until it pays back, then reuse the same funnel.
- Data (updated daily) · Launched 2026-09-24 · 11-07 installs 59,514 · Launched 2026-09-27 · India rating 7 · 11-08 charted in 3 stores
Android · Total installs worldwide Data 2026-10-29 → 2026-11-07 (10 days, 4 observations). Google's detail page only refreshes install counts every other day, so a flat day doesn't mean nobody installed.Android · Ratings count (cumulative) Data 2026-10-29 → 2026-11-07 (10 days, 4 observations)iOS · Top Grossing rank · by store Data 2026-10-31 → 2026-11-03 (4 days, 4 observations). Lower rank is higher; gaps mean it wasn't charted that dayiOS · Number of stores charted (top 200 on any chart) Data 2026-10-31 → 2026-11-03 (4 days, 4 observations)iOS · Ratings count · India Number of ratings 7Data day 2026-10-28, only 1 days so far. Apple doesn't give download counts, so rating growth is the proxy
On 2026 Oct 7, a user named Sara Retel left a review on Google Play for TOTPLY, a 2FA authenticator app: "u have to pay to see the code💔 there are other app that do it for free. dont waste ur money". TOTPLY only launched in Sep 24, and by Nov 6 it had 59.5k installs, 1,438 ratings, and a 4.6 rating. It's made by Remote Control TV LLC of Sharjah, UAE, whose main business is a TV remote subscription app. This is not a new product. It's a proven playbook copied again. Understanding how it took off is useful, but this spot isn't worth chasing.
What it is
A 2FA authenticator and password manager: scan a QR code to add accounts, generate 6-digit codes, fingerprint or face unlock, desktop widgets, watch support, a password generator, and the store page says it supports "1,500+ platforms." The website totply.com looks like a polished premium product, with the tagline "Security, beautifully simple."
The money comes from subscriptions. On Google Play, in-app purchases are priced at $2.99 to $89.99 each; on iOS it's $2.99 per week or $14.99–$39.99 per year. Reviews make it clear: after you scan the code, you have to pay before you can see the verification code.
A small detail: the Play store page says "multi-device sync, encrypted backup," but the website says "data stays only on your device, we don't store anything" (both read via 11-06). The two claims don't match.
Numbers: come in waves, as if ad budgets are being switched on and off
| Metric | Sources | |
|---|---|---|
| Installs | 10-29 is 50,840,11-06 is 59,514,7 days +8,674 | Google Play |
| Single-day peak | 10-25 one day +17k, 10-26 +5,600,10-27, 28 nearly 0 | Third-party estimates; between observations the values are averaged |
| Rating | 1,438 ratings, 4.6 score, 1,141 five-star ratings (79%) | Google Play,11-06 |
| Chart position | Only charted in free utility rankings: #129 Netherlands, #169 Sweden, #171 France; never on the overall or top-grossing charts | Google Play chart, 10-29 to 11-06 |
| iOS | Launched 9-27, 0 ratings in the US store; only appeared in the category top-grossing charts in Slovakia, Nepal, and Sri Lanka | App Store |
Jumped by over ten thousand in a few days, dropped back to near 0 the next day, then slowly climbed back to over a thousand a day. Organic search can't produce this shape; switching paid budgets on and off does (inference, most likely Google app ads; I didn't see the ad creatives directly). Its best chart position was #129 in the Netherlands utilities chart, and that ranking can't bring in this many installs.
Ratings make up 2.4% of installs, while typical utility apps get under 1%, and five-star ratings are about 80% of them. It's almost certain the app prompted for a rating at some point.
Where users come from: people searching "authenticator"
The demand is ready-made and year-round. More and more websites require two-step verification and tell users to "install an authenticator app," so users search "authenticator" in the store. Google Authenticator and Microsoft Authenticator together add about 3M installs a week (Google Play, 11-06), and the spillover search traffic is enough to feed a batch of paywalled clones.
TOTPLY captures traffic in three layers:
- The title is literally "Authenticator app", with the brand name TOTPLY placed after the colon.
- Brand terms stuffed into the disclaimer. The last paragraph of the store description reads: "We are not affiliated with Microsoft, Google, Authy, Apple, PayPal, Instagram, Meta, Facebook, TikTok, or GitHub." It looks like a disclaimer, but all ten brand terms get indexed for search.
- Buying search placement. The security blog den.dev wrote in November 2024 that ad slots in store search results often rank these re-skinned authenticators above the genuine apps.
There's no buzz on social media: no TikTok videos for "totply" come up in search, X has 0 posts, and no media outlet has written about it.
Why this company
Remote Control TV LLC has been making remote-control apps since 2025. Its Fire TV remote on Play has 596k installs and is still growing by 20k a week; its Fire Stick remote on iOS has 4,172 UK ratings and has charted in the utility top-grossing lists in the UK and Ireland. Remotes and authenticators share one thing: users come in a hurry searching a generic term ("TV remote", "authenticator"), and they need it to work right away, so a paywall converts best at that moment.
So TOTPLY moves the same setup to a second large search term: paywall, rating prompts, brand-term ASO, and ad accounts switched on or off based on payback. iOS and Play launched the same week, and it tested payback in cheap small markets like Slovakia, the Netherlands, and Sweden before deciding whether to add budget (inference). Whether the remote app funnels users to it is unverified.
Who it's competing with: twenty-plus identical ones
| Product | Launched | Play installs (11-06) | Compared with TOTPLY |
|---|---|---|---|
| Google Authenticator | 2012 | 342M | Free and official; TOTPLY is capturing the people searching for it |
| Microsoft Authenticator | 2015 | 246M | Free, enterprise use case |
| SafeAuth | 2023-06 | 36.9M | The leader of the same paywall playbook is 600 times its size |
| Starnest (Vietnam) | 2023-04 | 24.7M | Same playbook |
| Team2swift | 2022-09 | 11.6M | Same playbook |
| Universe Digital's 2FA Auth | 2025-06 | 2.78M, 7 days +93k | Entered a year later, growing 10 times as fast as TOTPLY |
| iKame / Begamob | 2026-07 | 355k, +15k in 7 days | Entered at the same time, 6 times its size |
| SWAPP | 2026-06 | 158k, +20k in 7 days | Entered at the same time, #11 in Malaysia's utility top-grossing chart |
| 2FAS, FreeOTP, Aegis | 2013–2017 | 2FAS 6.06M | Open source and completely free; the reviews' "use the free ones" refers to these |
At least 20 apps with authenticator, 2FA, or OTP in the title sell subscriptions, mostly from app factories in Vietnam, Turkey, and the UAE. TOTPLY entered late, and in scale it sits near the bottom of the group.
The playbook itself is no secret. Bitdefender wrote in 2023 that fake authenticators flooded the store after Twitter dropped SMS verification; den.dev wrote about it again in 2024, and Reddit discussed Apple's mass removal of subscription-scam authenticators. Revenue isn't public, but apps like this earn roughly 40 euros a year per subscriber, and they've been written up many times.
If it were you
Verdict: don't follow it. "Paywalled authenticators" have become an ad-buying race between app factories. The leader is hundreds of times TOTPLY's size, and the newcomers that arrived at the same time are also bigger. Users' other options are two free official apps from the big companies and several open-source ones. What's worth studying in TOTPLY is the method of copying across categories, not the authenticator itself.
Who it suits: small factories that already have a subscription app that pays back, have ad accounts and a paywall funnel, and want to reuse it on a second search term. These teams can use it as a reference: find a tool term with high search volume, where users need it right away and the big companies' versions are free but hard to find.
Who it doesn't suit: indie developers without paid acquisition experience or budget, and teams that want to win on product quality and word of mouth. This category isn't judged on product quality, it's judged on who bids higher, and the bad reviews, store removals, and public backlash all concentrate here (Apple did a mass cleanup in 2023).
How to do it: if you do try it, copy the method, not the category. Pick a tool term like the remote or authenticator, where users come in a hurry and generic names get searched more than brand names. Test payback in small countries (Slovakia, the Netherlands, Sweden types), switch budgets on in waves, and decide whether to scale based on payback data. Put the paywall before the user's first moment of value, but don't go as far as "pay before you can see the verification code," which is exactly why this category gets the most bad reviews and platform cleanups.
How to acquire users: store search ads plus generic terms in the title; rating prompts placed when users are first comfortable with the app; cross-promoting new products from existing ones. Products like this don't spread socially, so don't count on TikTok or X.
Is there a window to catch: no window left to rush. The category has been crowded since 2023, and entering now means bidding head-to-head against more than a dozen factories.
What would mean I got it wrong: ① TOTPLY climbs into a big market's top tools grossing chart within a month or two, #50 or higher, even catching up to the SafeAuth tier, which would show that a later entrant with better design and a better landing page can still take share; ② Google or Apple purges the paywall authenticators again, taking the top few down and opening a short window in search. Only teams with ad accounts ready will catch it, though.
Sources
- Google Play store page, reviews and description (com.remotetvsolutions.otp.android), 11-06 read; installs and ratings 10-29 to 11-06; daily installs are third-party estimates
- Google Play Tools free and grossing charts, 10-29 to 11-06; competitor installs 11-06
- App Store (id6813359189; Fire Stick TV Remote Control under developer id1782837378)
- Official site totply.com, 11-06 read
- den.dev, "Deceiving Authenticator Apps On Apple And Google Devices" (2024-11-22)
- Bitdefender, "Shady Authenticator Apps Flood Apple and Google App Stores…" (2023)
- Reddit r/apple discussion on Apple pulling authenticators that scam subscriptions
- Searched "totply" on TikTok and X, 11-06, no results; the Meta, Google and TikTok ad libraries don't index this developer. Not finding them doesn't mean they weren't running ads.
Android store page ↗ iOS store page ↗
Research notes: competitor table, acquisition evidence, full research report
- Competitors
Name Where Launched Scale How it differs from this one Google Authenticator Big-company features 2012 Play 342M installs, 7 days +1.58M Free and official; TOTPLY is capturing the traffic of people searching for it Microsoft Authenticator Big-company features 2015 Play 246M, +1.45M in 7 days Free, with enterprise push login Authenticator App - SafeAuth Android 2023-06 Play 36.9M; #19 in the Philippines TOOLS grossing chart The head of the same paywall playbook, roughly 600× TOTPLY's size Authenticator App(Starnest JSC) Android 2023-04 Play 24.7M Same playbook, Vietnamese factory Authenticator(Team2swift) Android 2022-09 Play 11.6M Same playbook 2FAS / FreeOTP / Aegis Open source 2017 / 2013 2FAS 6.06M and FreeOTP 5M installs Completely free; the "just use the free one" reviews point to these Proton Authenticator Big-company features 2025-07 600k on Play Free, end-to-end encrypted cloud sync, privacy brand Authenticator App - 2FA Auth(Universe Digital) Android 2025-06 Play 2.78M, 7 days +93k; #10 in Australia TOOLS grossing Same playbook, entered a year later, growing more than 10× as fast as TOTPLY Authenticator App - 2FA(iKame / Begamob) Android 2026-07 Play 355k, +15k in 7 days Newer entrant of the same period, 6× TOTPLY's scale - Where users come from
- Inferred Paid acquisition (likely Google App Campaigns): daily adds come in pulses (10-25 +17,069, falling back to 0 the next day), and chart position peaks at only TOOLS free #129, which organic ranking can't deliver at this volume. den.dev has documented store ad slots placing repackaged authenticators above the real apps. Our ad libraries don't track this developer.
- Confirmed Store search / brand-term ASO: the title is "Authenticator app"; the description's disclaimer lists brand terms including Microsoft, Google, Authy, PayPal, TikTok and GitHub, 10 in total
- Confirmed Rating prompts: about 2.4% of installs leave a rating, 79% of them five stars, well above the usual tools-category level
- Inferred Cross-promotion from an older product: the same developer's Fire TV remote has 596k installs on Play, adding 20k a week, and ranks #22 on the UK iOS tools grossing chart. Whether it promotes TOTPLY inside the app is unverified.
- Inferred TikTok / X / press / Reddit: TikHub, x-radar and web search turn up no discussion of it
Authenticator app: TOTPLY (com.remotetvsolutions.otp.android) research report
Channel: Google Play (also on iOS, id6813359189) | Developer: Remote Control TV LLC (Sharjah Media City, UAE) | Play launch 2026-09-24 | Research date 2026-11-06
Bottom line
TOTPLY is the second line from Remote Control TV LLC, a small app factory that makes subscription apps for TV remotes. It copies a paywall-authenticator playbook already proven to earn money. About 60k installs came almost entirely from a few concentrated paid pushes (peak day about 17k), not from chart position or organic spread. The product itself is no different from dozens of repackaged authenticators. It gets volume because the team has remote-app acquisition and subscription funnels, and because "Authenticator" is a large, steady search term. Calling it a breakout is a stretch: its scale sits at the tail of its category.
1. Data
| Metric | Value | Source |
|---|---|---|
| Play cumulative installs | 50,840(10-29) → 59,514(11-06), +8,674 in 7 days | googleplay library app_snap |
| Daily adds since launch | 10-11 about 9,300 → 10-12 +3,242 → 10-16 +2,682 → 10-21 +4,025 → 10-25 +17,069, 10-26 +5,644 → 10-27/28 almost 0 → 10-29 starting about 1,000–1,400 a day → 11-04/05 about 190 a day → 11-06 +1,061 | googleplay library app_day_ext (AppstoreSpy estimates; values between observations are averaged) |
| Rating | 1,438 reviews, 4.60 rating; distribution 1★42 / 2★42 / 3★63 / 4★148 / 5★1,141 | app_snap 11-06 |
| Rating / installs | About 2.4% (tools apps usually stay under 1%), with 79% five-star, which suggests rating prompts fire at key moments | Same as above |
| Chart position | Only ever appeared on TOOLS free category charts: #129 in the Netherlands (10-29), #169 in Sweden, #199 in the Netherlands (10-30), #171 in France (11-06); never charted overall or on grossing | chart_rank |
| In-app purchases | $2.99 – $89.99 per item; at recall, iOS weekly $2.99, annual $14.99–$39.99 | app_snap, recall card |
| iOS | 2026-09-27 launched, 0 ratings in the US store; in our data it appears only on category grossing charts in Slovakia #15, Nepal #48 and Sri Lanka #90 (small markets, very low bar) | iTunes lookup, appstore library |
| Version | 1.0 → 1.0.1 (10-27 update) | app_snap |
The growth curve comes in pulses: a few days of several thousand to over ten thousand installs, then it drops back near 0. That is the typical shape of paid budgets switched on and off (most likely Google App Campaigns testing); organic search does not look like this.
2. Competitors: authenticators are one of the most crowded categories on Play
| Product | Platform | Launched | Scale (googleplay library 11-06) | How it differs from TOTPLY |
|---|---|---|---|---|
| Google Authenticator | Big-company features | 2012 | 342M installs, +1.58M in 7 days | Free, official, cloud sync; TOTPLY captures people searching for "authenticator" |
| Microsoft Authenticator | Big-company features | 2015 | 246M, +1.45M in 7 days | Free, with enterprise push login |
| Authenticator App - SafeAuth | Android | 2023-06 | 36.9M; #19 in the Philippines TOOLS grossing chart; in-app purchases $4.99–$99.99 | The head of the same paywall playbook, roughly 600× TOTPLY's size |
| Authenticator App(Starnest JSC) | Android | 2023-04 | 24.7M; in-app purchases $6.99–$49.99 | Same playbook, Vietnamese factory |
| Authenticator(Team2swift) | Android | 2022-09 | 11.6M; #67 in Germany TOOLS grossing | Same playbook |
| 2FAS / FreeOTP / Aegis | Open source | 2017 / 2013 / — | 2FAS 6.06M, FreeOTP 5M | Completely free; users searching for "free" alternatives land here |
| Proton Authenticator | Big-company features | 2025-07 | 600k | Free, end-to-end encrypted sync, privacy brand |
| Authenticator App - 2FA Auth(Universe Digital) | Android | 2025-06 | 2.78M, 7 days +93k; #10 in Australia TOOLS grossing | Entered a year later with the same playbook, growing more than 10× as fast as TOTPLY |
| Authenticator App - 2FA(iKame / Begamob) | Android | 2026-07 | 355k, 7 days +15k; #21 in the Philippines TOOLS grossing | Newer entrant of the same period, 6× TOTPLY's scale |
| Authenticator - 2FA & MFA App(SWAPP) | Android | 2026-06 | 158k, 7 days +20k; #11 in Malaysia TOOLS grossing | New entrant from the same period |
| TOTP Authenticator(Sparrow Code) | Android | 2025-07 | 530k; #60 in France TOOLS grossing; $4.99–$79.99 | Same playbook |
At least 2 apps in our library have authenticator / 20FA / OTP in the title and subscription or in-app purchases, most from app factories in Vietnam, Turkey and the UAE. So the category has no shortage of competitors; it is saturated. TOTPLY arrived late and sits behind on scale.
3. Growth tactics
| Channel | Evidence | Confirmed? |
|---|---|---|
| Paid acquisition (likely Google App Campaigns / UAC) | Daily adds come in pulses: 10-25 peaked at +17k in one day, then fell back to 0 the next. Chart position peaks at only TOOLS free #129, which organic ranking can't deliver at this volume. den.dev (2024-11) documented Play and App Store search ad slots often placing repackaged authenticators above the real apps. Our Meta / Google / TikTok ad libraries don't track this developer, so there is no direct creative evidence. | No (inferred, fairly confident) |
| Store search / ASO term-riding | The title is "Authenticator app"; the disclaimer at the end of the description lists Microsoft, Google, Authy, Apple, PayPal, Instagram, Meta, Facebook, TikTok and GitHub. On the surface it's a disclaimer; in practice it gets those brand terms indexed. | Yes (the tactic is confirmed; how much traffic it brings is uncertain) |
| Rating prompt | Ratings / installs about 2.4%, five-star share 79%; 10-30→11-06 added 151 ratings | Yes (the method can be inferred from the data) |
| Cross-promotion between the developer's apps | The same developer's Remote for Fire TV & FireStick has 596k installs, +20k per week (googleplay library); the iOS Fire Stick Remote charted #22 in the UK Utilities Top Grossing and #18 in Ireland (appstore library). That suggests a mature subscription funnel and paid acquisition accounts. Whether the remote app pushes TOTPLY is unverified. | No |
| TikTok / X / Reddit / press | TikHub search for "totply" returned no related videos; x-radar: 0 posts; Jina search only returned the official site, store pages, APKPure, and Similarweb indexing pages. | Confirmed none |
4. Why it took off
- The demand is ready-made and long-lasting. Platforms keep pushing 2FA, so users are told to "install an authenticator app" and head to the store to search "authenticator." The term gets steady volume all year, and Google and Microsoft alone add about 3M installs every 7 days (googleplay library). That spillover search traffic is enough to support a batch of paywall clones.
- Why users pay: users assume it's an "official authenticator," scan a code, then find they need a subscription to see the verification code. In a hurry to log in, they pay, or they enter the free trial and get auto-charged. A visible store review: "u have to pay to see the code … there are other app that do it for free. dont waste ur money" (Sara Retel, 2026-10-07, Play store page). Bitdefender and den.dev have both publicly written that these apps earn from subscriptions of around €40 per year.
- A team that buys traffic. Remote Control TV LLC has run a remote-control subscription app since 2025 (Play 596k installs; on iOS it charted in the UK, Germany, Canada, and Ireland). TOTPLY essentially moves the same funnel (paywall, rating prompt, brand-term ASO, budget switched on and off based on payback) onto a second large search term.
- Launch on both ends, test in small markets first. iOS and Play launched the same week. On iOS it briefly charted in low-cost countries like Slovakia, Nepal, and Sri Lanka. Play placements showed up in the Netherlands, Sweden, and France, which suggests payback was tested country by country.
5. Differentiation
The surface pitch is "data stored locally, Face ID lock, password manager, password generator, widgets / watch, 1,500+ platforms," and the website totply.com uses a premium "Security, beautifully simple" look. But SafeAuth, Starnest, and Team2swift have these features too, and some have more. Only two things really set it apart: the website and visuals look more like a serious product, which may help paid conversion, and selling a password manager alongside it makes an annual fee easier to justify. Neither is why it took off. It took off because of paid acquisition budget and the "authenticator" search term. The product is in the "good enough" category.
6. How many people know about it
Few people know about it yet. No media coverage; X and TikTok show 0, and revenue isn't public. But the "paywalled authenticator" model itself has been repeatedly exposed by security media (Bitdefender 2023 wrote that after Twitter stopped SMS 2FA, fake authenticators flooded the stores; den.dev 2024-11 wrote about similar things; Reddit r/apple has also discussed Apple removing authenticators that scam subscriptions). The model is an open secret, and the category is already crowded.
7. Copycats
I found no product copying TOTPLY itself. It is a follower of the SafeAuth type. Others that entered around the same time include iKame/Begamob (2026-07), SWAPP (2026-06), LifeTools Studio (2026-07), and XSOFT (2026-04), all with larger volume.
8. What others can borrow
- App-factory "search-term transplant": take a high-volume utility term with urgent user intent (remote controls, authenticators), and copy the same paywall, rating prompt, and paid acquisition funnel across categories.
- Putting the brand term into a "disclaimer" for ASO sits at the edge of Play policy.
- Use small countries (Slovakia, Nepal, the Netherlands, Sweden) to test payback cheaply before deciding whether to add budget; run paid campaigns in bursts.
- Risk: this category carries high store-policy and public-opinion risk (Apple did a major cleanup 2023 years ago), and the negative reviews cluster around "pay to see the code." It's not a direction for product-focused teams.
9. Still unclear
- Which paid channels they use, how much budget, and what payback looks like (ad libraries don't track this developer at all).
- Whether the +17k installs on 10-25 came from paid acquisition, cross-promotion from the remote app, or both.
- Real iOS downloads in the US store: 0 ratings, possibly mostly paid on Android.
- Paid rate, trial conversion, refund rate; whether the rating prompt only appears after payment or at specific moments.
- The recall card says the developer has "3 apps, about 650k installs": on Play this developer has only 2 apps (Fire TV remote + TOTPLY); the third is the iOS FreeBox remote.
Sources
- Play store page: play.google.com/store/apps/details?id=com.remotetvsolutions.… (developer address: Sharjah Media City, UAE; email [email protected])
- iOS: itunes.apple.com/lookup?id=6813359189; developer id 1782837378
- Website: totply.com/, totply.com/privacy
- den.dev, "Deceiving Authenticator Apps On Apple And Google Devices" (2024-11-22): den.dev/blog/beware-deceiving-authenticator-apps/
- Bitdefender, "Shady Authenticator Apps Flood Apple and Google App Stores…": www.bitdefender.com/en-us/blog/hotforsecurity/shady-authenti…
- Reddit r/apple:www.reddit.com/r/apple/comments/119x9ih/apple_is_finally_rem…
- Internal libraries: googleplay (app_snap / app_day / app_day_ext / chart_rank / app_profile, as of 2026-11-06), appstore (app_profile), metaads / googleads / tiktokads (no results), x-radar, TikHub