Authenticator app: what it is and what it's for
An authenticator app generates the codes for your two-step verification right on your own phone, with no network needed. If those codes have no backup anywhere else, they live and die with that phone.
- What it is
- An app that generates your codes
- Since
- 2010 (Google Authenticator)
- Verdict
- Yes, but…
What it is
An authenticator app is installed on your phone and calculates, usually with TOTP, the code you need to complete your two-step verification. It doesn't send anything by SMS and doesn't need a connection: all the calculation happens inside the app itself, based on a secret you received when you set it up.
Google Authenticator, Microsoft Authenticator, Authy and Aegis are well-known examples. They all do the same thing under the hood; they differ in whether they back up that secret or not.
When it was introduced
Google launched Google Authenticator in 2010, as a companion app to its newly launched two-step verification. For years, the app only stored codes on the phone itself, with no backup; in April 2023, Google finally added the option to sync them to your Google account in the cloud.
Why it's used
It's used because it's free, works without coverage or a carrier, and is harder to intercept than an SMS. For anyone setting up 2FA on many accounts, it's the most practical option.
The flip side: if the app doesn't back up to the cloud and isn't also installed on a second device, the secret that generates the codes exists in exactly one place. Lose that phone and you instantly lose access to the second factor for every account you protected with it.
Should you use it?
Yes, but only with an encrypted cloud backup or installed on two devices. Without that, the authenticator app is just another single point of failure dressed up as security.
Check this
- Does your authenticator app back up to the cloud, or does it only live on this phone?
- Do you have the same authentication account also set up on a second device?
- Do you know what would happen to your codes if this phone broke right now?
Sources: Set up Google Authenticator (Google) · Google Authenticator adds cloud sync (TechCrunch, Apr. 2023)