Authenticator app: what it is and how to choose one
SHORT ANSWER
What is an authenticator app?
An authenticator app is a phone app that makes one-time codes for two-step verification. Each site shares a secret with the app once. After that the app makes a fresh six-digit code every 30 seconds, which you enter with your password. It works offline and is stronger than SMS codes.
Key takeaways
- The app holds secrets and makes codes on the phone. No code travels over the phone network.
- Choose by backup and recovery first, then privacy, then lock and convenience.
- Any app that follows the TOTP standard works with the same sites, so you can switch later.
- An authenticator app is good. A passkey is better where a site supports it.
Disclosure: HostSpica makes HostSpica Identity, which competes with the apps named here. Facts about other products come from their own documentation, checked on 4 October 2026, and can change.
What it is
An authenticator app is software on your phone that makes the second code you type after your password. When you turn it on for an account, the site gives your app a secret. From then on the app and the site each compute the same code from that secret and the time. If your password is stolen, the thief still needs the code, which exists only on your phone.
Types of authenticator apps
| Type | What it does | Examples of what you will see |
|---|---|---|
| Code generator | Makes TOTP codes for any site | Google Authenticator, HostSpica Identity, many others |
| Code generator plus vendor sign-in | Codes plus push approval or passwordless sign-in for the vendor's own accounts | Microsoft Authenticator |
| Password manager with codes | Codes stored next to passwords | Several password managers |
| Passkey manager | Holds passkeys instead of codes | Passkey providers, including HostSpica Passkey |
How to choose: a checklist
- Backup and recovery. Can you restore every account on a new phone? Look for an encrypted backup you control or a sync you trust, and make one on day one.
- Standard codes. The app should use TOTP so your codes work everywhere and you can leave later.
- Import and export. Can it read Google Authenticator's export QR and make one? That keeps you from being locked in.
- Lock. It should ask for your fingerprint, face or screen lock before it shows codes.
- Privacy. Read what it collects. Check the permissions: an app with no internet permission cannot send anything.
- Maintenance. It should be updated, and you should know who makes it.
How it keeps accounts safer
- A stolen password alone is no longer enough to sign in.
- Codes are one-time and expire in 30 seconds.
- Nothing is sent over the phone network, so SIM swaps and text interception do not apply. See SMS vs authenticator app vs passkeys.
What it does not do
Where HostSpica Identity fits
HostSpica Identity is a free, local-only app: no account, no sync, no internet permission, an encrypted backup file you keep, and QR import from Google Authenticator. Read how it keeps secrets in where every secret lives. Its Google Play release is in the final steps as of 4 October 2026, so check the app page for the live link.
Frequently asked questions
Are authenticator apps safe?
They are much safer than a password alone and safer than SMS. They are not immune to phishing relays or a compromised phone.
Do authenticator apps work without internet?
Yes. They make codes on the phone. You need internet only for the site you are signing in to.
Can I use more than one authenticator app?
Yes, but each account's secret lives in the app you scanned it into. You can add the same account to two apps by scanning the QR code in both at setup.
What is better than an authenticator app?
A passkey, where the site supports it, because it cannot be used on a fake site.
References
Review status
Last technical self-review by the author on 4 October 2026. No independent reviewer yet. If you spot an error, write to [email protected] and we will correct it and note the change.
Rohan builds HostSpica's Android apps — Authenticator, Passkey and Identity — and writes up how they work, including the mistakes along the way.
ABOUT THE PRODUCTS
RELATED