What is an authenticator app?

An authenticator app makes the six-digit codes you type after your password when two-factor login (2FA) is on. When you set it up, the service shows a QR code with a secret key. The app stores the key and, from it and the current time, calculates a new code every 30 seconds. It works offline, and each code is useless a moment later.

How the codes are made

The QR code holds a secret key that only the service and your phone know. Every 30 seconds the app combines the key with the current time and turns the result into a six-digit number. The service does the same calculation; if the numbers match, you're in. The method is an open standard called TOTP (RFC 6238), which is why any authenticator app works with any service that offers “authenticator app” as an option.

Nothing is sent to the phone, so the app works in airplane mode too. It's also why the phone's clock matters: if it's off by a minute or more, codes usually get rejected (how to fix that).

Why it's safer than codes by text message

• A text message travels over the phone network. Someone who takes over your number – for example by talking your carrier into a new SIM card, called SIM swapping – gets your codes too. An authenticator app's key stays on your phone.
• It works abroad, without signal and without a phone number.
• After setup, the key never leaves the phone, so there's nothing to intercept along the way.

It isn't perfect: a convincing fake sign-in page can ask for your code and use it straight away. Check the address before you type a code. Passkeys can't be phished like that, where a service supports them.

How to set it up

1. Install an authenticator app.
2. At the service, open the security settings, find two-factor or two-step login, and pick authenticator app (not text message).
3. Scan the QR code with the app. Can't scan? Most services also show the key as text you can type in.
4. Type the current code from the app to confirm.
5. Save the backup codes the service shows you – somewhere other than your phone. They get you in if the phone is lost.

Which app?

They all make the same codes, so the difference is where your keys are kept and how they move to a new phone:

• Google Authenticator can save codes to your Google Account, or work without an account. Moving it to a new phone.
• Microsoft Authenticator also handles sign-in approvals for Microsoft and work accounts, and backs up to iCloud or your Microsoft account. Moving it to a new phone.
• Password managers – Apple's Passwords app on iPhone, 1Password, Bitwarden – can keep the code next to the password.
• Separate apps such as 2FAS, Ente Auth and Kode keep codes apart from passwords, so one leak doesn't give away both.

A few services use their own app instead – Steam Guard, for example. And one-tap approvals (“Is this you? Yes”) are a feature of that service's own app, not of authenticator apps in general.

If you lose your phone

The key exists only where the app keeps it. If it was synced or backed up, you get it back on the new phone. If not, it's gone: sign in with a backup code or the service's account recovery, then set up two-factor login again. That's why the backup codes matter.

Kode

Kode is an iPhone app by Peter Theill ($1.99 once) that makes these codes, with no account, no ads and no network calls. Your keys live in the iPhone's Keychain and follow you to a new iPhone through iCloud Keychain, which is end-to-end encrypted. It can take over your codes from Google Authenticator and other apps: Move your codes to Kode.