The short version: an authenticator app is a phone app that shows a short code. You type the code after your password. It is a stronger second step than a text message.
Our disclosure. SafeinAI has no affiliate links and earns nothing if you pick any of these apps. We list built-in options first and say which choices are free. If this ever changes we will say so here, on this page.
You may see a square code on the screen. That can be normal.
You turn on two-factor authentication (2FA) for an account. The site then shows a square black-and-white pattern. This is a QR code. It asks you to scan it with your phone camera. If you opened the account’s own security settings page yourself, this is a normal setup step.
What an authenticator app is
An authenticator app makes a code, usually six digits. The code usually changes every 30 seconds. The app works without mobile signal or internet, because your phone calculates the code.
When you scan the QR code, the site and your app share a secret. Both use the secret and the clock to calculate the same code at the same time. The technical name is a time-based one-time password (TOTP). It is described in a standard called RFC 6238, which suggests 30 seconds but lets each service choose.
You may also see “2-step verification (2SV)”, the term often used in the UK. It means the same as 2FA.
Which app to pick
Ask these questions first:
- Can I move my codes to a new phone, or restore them if I lose this one?
- Does it have a backup option I understand?
- Is it simple to use?
- Does it show ads?
- Is it from a company or project I can name?
Here are options, in alphabetical order inside each group. We checked them on 25 Oct 2026. Apps change, so read the app’s page before you install. This is a list of examples, not a ranking.
Built into your phone or from a big company
- Apple Passwords is on iPhone, iPad and Mac. Apple says it makes codes without text messages or extra apps.
- Google Authenticator is on Android and iPhone. If you sign in with a Google Account, your codes sync (copy automatically) to your devices. You can also use it without an account. Then the codes stay on that phone.
- Microsoft Authenticator is for iPhone and Android. Microsoft says it is not available for PC or Mac. It can back up codes. Backups restore only to the same kind of phone (iPhone to iPhone, Android to Android).
Inside a password manager
- 1Password is paid. It stores codes with your logins.
- Bitwarden Password Manager can store codes. Its help page says free accounts can store keys, and Premium shows the codes.
Standalone apps
- 2FAS (iPhone and Android) says it is free and needs no account.
- Aegis (Android only) is free and open source (anyone can read its code).
- Bitwarden Authenticator (iPhone and Android) is free and needs no Bitwarden account.
We did not review Authy because we could not confirm its current device and backup support.
Set it up on your email account
This example uses a Google Account. Other email services are similar.
- On a computer, open your Google Account. Choose Security & sign-in, then 2-Step Verification.
- Choose the authenticator app option. Google’s page calls it Set up authenticator.
- A QR code appears. Open your app, choose the add button, and scan the code with your phone camera.
- The app shows a code. Type it on the site to confirm.
- Save the backup codes the site gives you. See recovery codes and backups.
If you cannot scan: the site also shows a setup key, a long text code. Copy it into the app instead. Anyone with this key can make your codes, so keep it private. Do not post it or save it in a chat.
If you use Google Authenticator, Google says it may take up to 7 days before it shows as a sign-in option. Google also advises adding another second step, so you do not lose access to your account.
Backups, and moving to a new phone
The most common problem is a new phone. If you erase or replace your old phone first, your codes may be gone.
- Before you switch, check how your app moves codes. Each app has its own steps.
- Move the codes, then test one on the new phone.
- Only then erase the old phone.
Examples: Google Authenticator can export codes to a QR code on the old phone, then import them on the new one. 2FAS moves between iPhone and Android through an exported backup file. Bitwarden Authenticator uses your phone’s cloud backup, or an export file.
Save each account’s backup codes too. They help you get back in.
Limits
Authenticator app codes are stronger than text-message codes. CISA, a US cyber agency, says that app codes can still be tricked by phishing. Phishing means a fake site that copies a real one. A fake site can ask for your password and your code, then use both at once.
- A passkey is stronger against fake sites. See passkeys.
- Never type a code on a page you reached from an unexpected message. Go to the site yourself instead.
- Never scan a QR code that arrived in an unexpected email or text. These can lead to fake sites.
- A real company should never ask you to read a code out to someone who contacted you.
If a site offers only text-message codes, use them for now. See why not text-message codes.
If you gave a code to a scammer: in the US, report it at reportfraud.ftc.gov. In England, Wales and Northern Ireland, use Report Fraud (formerly Action Fraud) at reportfraud.police.uk. In Scotland, call Police Scotland on 101. In the UK, you can forward suspicious emails to report@phishing.gov.uk. See also secure your email.
Do this today (about 9 minutes if you already have an app)
- Use the authenticator in your phone or password manager, or pick one from the list above and install it.
- On a computer, open your main email account’s security settings and choose the authenticator app option.
- Scan the QR code, type the code the app shows, and save the backup codes in a safe place.
Never share a code or a setup key with anyone.
Checked: 25 Oct 2026. Settings screens change. If yours looks different, search the company's help page.
