How authenticator codes work
When you turn on two-step login, the site shows a QR code. The app saves the secret inside it and from then on shows a new code every 30 seconds, as Microsoft's App Store listing describes for its app. FreeOTP and Authy say their codes are made on the phone, so they work in airplane mode.
FreeOTP says it implements the TOTP and HOTP standards, the time-based and counter-based one-time passwords, so it works with any server that uses them. Microsoft lists Facebook, Amazon, Google and GitHub among the non-Microsoft accounts its app can hold. Our guide two-factor authentication methods compares app codes with text messages and security keys.
Plan for a lost phone
If your phone breaks and the codes were only on it, you can lock yourself out. Check how your app keeps a copy:
| App | Backup or sync, as the vendor states it |
|---|---|
| Google Authenticator | Sync to your Google Account, or move codes by QR code |
| Microsoft Authenticator | Cloud backup to iCloud or a Microsoft personal account, no restore across iOS and Android |
| Ente Auth | End-to-end encrypted cloud backup and sync, export |
| Proton Authenticator | Encrypted sync with a Proton Account, export |
| 2FAS Auth | iCloud backup with an optional password, export of OTP links |
| Aegis | Automatic backups to a folder you choose, plain or encrypted export |
| Bitwarden Authenticator | Your phone's own backup service |
Also save the recovery codes each site shows when you turn on two-step login. Store them away from the phone, for example in your password manager or on paper.
Moving to another app
You do not have to set up every account again when you switch. Google Authenticator exports codes as one or more QR codes that another phone can scan. Aegis imports from 2FAS, Authy, FreeOTP, Google Authenticator, Microsoft Authenticator and others, though some imports need root access. Proton Authenticator imports from Google Authenticator, 2FAS, Aegis, Bitwarden Authenticator, Ente Auth and LastPass Authenticator.
Keep the old app until you have logged in once with each code from the new one. Then delete the codes from the old phone.
Free tools for 2FA
- 2FA code generator: make a code from a setup key in your browser, for testing or a one-off login.
- QR code scanner: read a setup QR code to see the key and settings inside it.
- Password generator: a strong password to go with your second factor.
We opened each app's official page or app store listing on the date in the table and wrote down only what it says. Some well known apps are missing because their pages could not be opened that day.
Frequently asked questions
Which authenticator apps are open source?
Aegis (GPL-3.0, Android), Ente Auth (AGPL-3.0), FreeOTP (Apache 2.0) and the 2FAS Android app (GPL-3.0) publish their code under a named license. Proton and Bitwarden also say their authenticator apps are open source.
What happens to my codes if I lose my phone?
That depends on the backup. Google Authenticator can sync codes to your Google Account, Ente Auth and Proton Authenticator sync encrypted codes to an account, and Aegis and 2FAS can write backup files. Without a backup you need the recovery codes each site gave you.
Can I use an authenticator app on my computer?
Yes. Ente Auth has apps for macOS, Windows, Linux and the web, Proton Authenticator runs on Mac, Windows and Linux, and Zoho OneAuth is available for Windows. Apple's Passwords app also fills in verification codes on the Mac.
Do I need an account to use an authenticator app?
Not for most of them. 2FAS, Proton Authenticator and Bitwarden Authenticator say they work without an account, and Ente Auth has an offline mode. You need an account only for the cloud sync some apps offer.
Can I move my codes out of Google Authenticator?
Yes. Google's help page says you can export codes as a QR code on the old device and scan it on the new one. Apps like Aegis and Proton Authenticator can import codes from Google Authenticator.