Authenticator app download: how to get one safely
SHORT ANSWER
How do I download an authenticator app safely?
Install it only from Google Play or the Apple App Store, or from the maker's own official link. Check the publisher name and the app's package name, avoid APK files from other sites, and review the permissions. Never install a program that claims to be an authenticator for PC from an unknown site.
Key takeaways
- Use the official store listing and check the publisher. Fake authenticator apps exist because they can collect secrets.
- Package names are a quick check: Google Authenticator is com.google.android.apps.authenticator2, Microsoft Authenticator is com.azure.authenticator and HostSpica Identity is com.hostspica.identity.
- Do not download APK files from other websites for an app that holds secrets.
- After installing, make a backup and save recovery codes before you rely on it.
Disclosure: HostSpica makes HostSpica Identity, which competes with some products named here. Facts about other products come from their own documentation, checked on 4 October 2026, and can change.
Where to download from
- Android: Google Play. Open the store on your phone or follow the maker's own link to it.
- iPhone and iPad: the Apple App Store.
- Not recommended: APK files from third-party sites, download buttons on lookalike pages, or ads that promise a free authenticator for your PC.
How to tell the real app from a fake
- Publisher. Check the developer name on the listing against the company that makes the app.
- Package name. On Android the package is in the page address after
id=. Compare it with the table below. - Install count and age. A famous app with a few hundred installs is suspicious.
- Permissions and data safety. Read the data safety section and the permissions the listing shows.
- Reviews. Look for reviews about stolen accounts or lost codes, and be wary of a wall of identical five-star reviews.
| App | Android package | Maker |
|---|---|---|
| Google Authenticator | com.google.android.apps.authenticator2 | |
| Microsoft Authenticator | com.azure.authenticator | Microsoft |
| HostSpica Identity | com.hostspica.identity | HostSpica |
Before you scan your first code
- Open the app and set a lock so it asks for your fingerprint, face or screen lock.
- Add a low-risk account first and check the code works.
- Make an encrypted backup of your accounts and save each site's recovery codes.
- If you are moving from another app, follow the step-by-step guide.
Checking an app's permissions yourself
An authenticator does not need internet access to make codes. You can look at any installed app's permissions with a free tool and aapt2, as shown in how to check that an Android app has no internet permission. An app that makes codes and also asks for contacts, location or SMS deserves a second look.
Get HostSpica Identity
HostSpica Identity is free, has no account, declares no internet permission, and can import Google Authenticator's export QR code. Its Google Play release is in the final steps as of 4 October 2026, so check the app page for the live link.
Frequently asked questions
Is it safe to download an authenticator from outside Google Play?
Avoid it. An APK from another site cannot be checked the way a store listing can, and an authenticator holds your most sensitive secrets.
Which authenticator app should I download?
One from a maker you can identify, that follows the standard TOTP, lets you back up and move your accounts, and locks with your fingerprint or screen lock.
Do I need to pay for an authenticator app?
Google Authenticator, Microsoft Authenticator and HostSpica Identity are free. Be wary of a paid app that offers nothing more.
Can I download an authenticator for my laptop?
There are options, but they carry trade-offs. See the article on Google Authenticator on a PC.
References
Review status
Last technical self-review by the author on 4 October 2026. No independent reviewer yet. If you spot an error, write to [email protected] and we will correct it and note the change.
Rohan builds HostSpica's Android apps — Authenticator, Passkey and Identity — and writes up how they work, including the mistakes along the way.
ABOUT THE PRODUCTS
RELATED