Google Authenticator: what it is, how it works, and alternatives
SHORT ANSWER
What is Google Authenticator?
Google Authenticator is a free app from Google for Android and iOS that makes the six-digit codes used for two-step verification. The codes are made on your phone from a secret you share with a site once, so they work offline. You can sync them with your Google Account or transfer them by QR code to a new phone.
Key takeaways
- It makes time-based codes on the phone, so it works without a signal. The phone's own clock is used for the time.
- Codes can be synced to your Google Account, or moved with Transfer codes, then Export codes, and Import codes on the new phone.
- Google's help says it encrypts Authenticator codes in transit and at rest, and the app has a Privacy Screen that asks you to verify before it opens.
- It is a good basic app. Compare backup, recovery and privacy before you rely on it for everything.
Disclosure: HostSpica makes HostSpica Identity, which competes with the apps named here. Facts about other products come from their own documentation, checked on 4 October 2026, and can change.
What Google Authenticator is
Google Authenticator is a free app for Android and iOS that makes verification codes for sites that offer two-step verification. When you turn on an authenticator app for an account, the site shows a QR code that holds a secret. The app stores it and then makes a new six-digit code every 30 seconds. You type the current code after your password. The standard behind this is TOTP, explained in how TOTP works.
How it works
- A site offers an authenticator app and shows a QR code. In Google Authenticator tap Add and scan it.
- The app saves the secret and starts showing a code with a countdown.
- You enter the code on the site once to confirm, and the site turns the protection on.
- From then on, sign-in asks for your password and the current code.
The code is computed on your phone from the secret and the time, so no network is involved. Version 7.0 and newer use the time setting of the phone's operating system, so keep automatic date and time on.
Sync and moving to a new phone
Google Authenticator can sync your codes with your Google Account, so a new phone that you sign in to gets them. Google's help recommends this to avoid being locked out when you change devices. You can also move codes by hand: on the old phone open the menu, choose Transfer codes, then Export codes, and on the new phone choose Transfer codes and Import codes to scan the QR code.
Security features
- Privacy Screen: in Settings you can require device verification before the app shows codes.
- Lost phone: Google's help says you can remotely erase a lost device or remove it from your Google Account.
- Offline: codes need no signal.
Where it falls short
- No desktop app. Google's help describes the phone app only. See Google Authenticator on a PC.
- Recovery depends on sync or recovery codes. If you did not sync and lose the phone, you need each site's recovery codes.
- Phishable like every code. A fake page can ask for the code and relay it. See SMS vs authenticator app vs passkeys.
Google Authenticator and alternatives
| Google Authenticator | Microsoft Authenticator | HostSpica Identity | |
|---|---|---|---|
| Cost | Free | Free | Free |
| Works offline | Yes | Yes (codes) | Yes |
| Account needed for sync | Optional Google Account sync | Microsoft account for backup and sign-in features | No account; no sync |
| Backup | Google Account sync or QR transfer | Cloud backup in the app | Password-protected backup file you keep |
| Import from Google Authenticator | n/a | Add accounts again by QR | Scan Google's export QR code |
| Internet permission | Check it yourself with aapt2 | Check it yourself with aapt2 | None declared (checked on the release build) |
To move from Google Authenticator to HostSpica, follow the step-by-step guide. HostSpica Identity's Google Play release is in the final steps as of 4 October 2026, so check the app page for the live link.
Frequently asked questions
Is Google Authenticator safe?
It uses standard TOTP and Google says it encrypts codes in transit and at rest. No code-based method stops a fake page that relays your code, so use passkeys where a site offers them.
Does Google Authenticator work offline?
Yes. Codes are made on the phone from the secret and the clock, with no network.
What if I lose my phone with Google Authenticator?
If you synced to your Google Account, sign in on a new phone to get the codes back. Otherwise use each site's recovery codes. See what to do if you lose your phone.
Is there a Google Authenticator for Windows or Mac?
Google's help describes mobile apps only. There are other ways to get codes on a computer, with trade-offs.
References
Review status
Last technical self-review by the author on 4 October 2026. No independent reviewer yet. If you spot an error, write to [email protected] and we will correct it and note the change.
Rohan builds HostSpica's Android apps — Authenticator, Passkey and Identity — and writes up how they work, including the mistakes along the way.
ABOUT THE PRODUCTS
RELATED