How to Use an Authenticator App

An authenticator app generates a six-digit code on your phone that changes every 30 seconds. When you log in to an account with two-factor authentication enabled, you enter your password as normal, then open the app and type in the current code. Even if someone has your password, they cannot log in without that code — and it expires before they can use it. This guide covers how to set up and use the most popular authenticator apps.

Which Authenticator App Should You Use?

The three most widely used authenticator apps are:

• Google Authenticator — simple, lightweight, free. Available on iOS and Android. Good for personal accounts.
• Microsoft Authenticator — integrates well with Microsoft and work accounts. Supports push notifications for Microsoft logins so you just tap Approve rather than entering a code. Free on iOS and Android.
• Authy — popular alternative with cloud backup, meaning you can recover your codes if you lose your phone. Free on iOS and Android.

All three work with most websites and services. If you use Microsoft 365 for work, Microsoft Authenticator is the natural choice. For everything else, any of the three will do the job.

How to Set Up Google Authenticator

1. Download Google Authenticator from the App Store or Google Play.
2. Open the app and tap Get started.
3. On the website or service you want to secure, go to its security or account settings and find the two-factor authentication option.
4. Choose Authenticator app as your 2FA method. The site will display a QR code.
5. In Google Authenticator, tap the + button at the bottom right, then Scan a QR code.
6. Point your camera at the QR code on screen.
7. The account appears in your app, showing a six-digit code. Enter this code on the website to confirm setup.

That account is now added. Next time you log in, you will need to open the app and enter the current six-digit code.

How to Set Up Microsoft Authenticator

1. Download Microsoft Authenticator from the App Store or Google Play.
2. Open the app and tap Add account.
3. Choose your account type: Personal Microsoft account, Work or school account, or Other.
4. For a Microsoft personal account, sign in and follow the prompts — Authenticator will link automatically.
5. For other accounts such as Google or Facebook, select Other and scan the QR code displayed on that site.

For Microsoft 365 work accounts, your IT team may ask you to set up Microsoft Authenticator as part of onboarding. The process is the same — open the app, add an account, and scan the QR code provided.

How to Add an Account Using a Setup Key

Some sites offer a text-based setup key instead of a QR code. In Google Authenticator, tap the + button then Enter a setup key. Type in the account name and the key provided by the website. Select Time-based and tap Add. The same option exists in Microsoft Authenticator under the manual entry option.

How to Use Your Authenticator App at Login

1. Enter your username and password on the site as normal.
2. When prompted for a verification code, open your authenticator app.
3. Find the account in your app — it will show a six-digit code with a countdown timer.
4. Type the code into the website before it expires. Codes refresh every 30 seconds.

If the code expires before you enter it, just wait — a new one will appear automatically and work straight away.

What If I Get a New Phone?

This is the most common problem with authenticator apps. Each app handles it differently:

• Google Authenticator — since 2023, supports Google account backup. Make sure backup is enabled in Settings before you change phones.
• Microsoft Authenticator — supports cloud backup via iCloud on iOS or your Microsoft account on Android. Enable in Settings before switching devices.
• Authy — designed with phone changes in mind. Accounts are backed up to Authy cloud automatically.

If you switch phones without backing up first, you will need to use recovery codes for each account. This is why saving backup codes at setup is so important — every service provides them when you first enable 2FA.

Is an Authenticator App Safer Than SMS Codes?

Yes, significantly. SMS codes can be intercepted through SIM swapping — where an attacker convinces your mobile network to transfer your number to their SIM. Authenticator app codes are generated locally on your device and never transmitted over the phone network, making them immune to this attack.

For the very highest security on critical accounts, a hardware key like the YubiKey goes one step further — it cannot be phished even by convincing fake login pages.

If you have not yet enabled two-factor authentication on your accounts, start with our guide on how to set up 2FA — it covers Google, Microsoft, Facebook, and Amazon step by step.