An authenticator app turns the QR code a service shows you into a fresh 6-digit code every 30 seconds. Any standard app works with any service that supports "authenticator app", "TOTP" or "Google Authenticator", so you can switch apps later.
What to look for
- Backup or sync. If your phone is lost, can you get your codes back? Some apps back up to your account or cloud; check that the backup is encrypted.
- Export. Being able to move codes to a new phone or another app saves you resetting every account.
- A lock. A passcode or Face ID on the app itself stops someone with your unlocked phone from reading codes.
Common choices
| App | Platforms | Good to know |
|---|---|---|
| Google Authenticator | iPhone, Android | Simple. Can sync codes to your Google account, or transfer them to a new phone by QR code. |
| Microsoft Authenticator | iPhone, Android | Also handles push approvals for Microsoft accounts. Can back up to your Microsoft account. |
| 2FAS | iPhone, Android | Free and open source, with optional encrypted backup. |
| Aegis | Android | Free and open source, encrypted vault, local encrypted backups. |
| Password manager (1Password, Bitwarden and others) | Everywhere | Keeps the code next to the password and syncs it. Convenient, but puts both factors in one place, so protect the manager itself with a strong second factor. |
Backup codes
When you turn on two-factor sign-in, most services give you a set of one-time backup codes. Save them. They're how you get in if your phone is lost, broken or reset. Good places: your password manager, or printed and kept with your important papers. Not good: a screenshot in the same phone.
Moving to a new phone
Move your codes before you wipe or trade in the old phone. Use the app's transfer or backup feature, then sign in to a couple of accounts with the new phone to check it works. See Recovery if it's too late.