What is an authenticator app, and do you actually need one?

An authenticator app is a small app that generates a rotating 6-digit code for each account you add to it. When you sign in somewhere, the site asks for your password and that code — so a stolen password on its own is no longer enough.

What it actually does

When you switch on two-factor authentication at a service, it shows a QR code. Scanning it hands your app one shared secret. From then on, the app mixes that secret with the current time to produce a code that changes about every 30 seconds. The service runs the same calculation and checks the answers match.

That has two useful consequences:

• Nothing is sent to your phone. There's no text message to intercept.
• It works with no signal. The maths happens on your device, so codes keep coming on a plane or in a dead spot.

This standard is called TOTP — we explain it in how TOTP codes work.

Why not just use SMS?

SMS codes are better than nothing, but they travel over the phone network, where they can be redirected with a SIM-swap attack. An authenticator app removes that entire category of risk, which is why most security guidance now prefers it. We compare the two in authenticator app vs SMS.

Do you need one?

If you only ever sign in to one low-stakes account, probably not. For anyone else, the honest answer is yes — and you should start with the accounts that unlock everything else:

1. Your email, because password resets land there. See secure your email first.
2. Anything with money attached — banking, payments, crypto.
3. Accounts other people rely on — work tools, social profiles.

Getting started

Adding your first account takes about a minute: scan the QR code, or type the setup key if scanning isn't possible. Then save the recovery codes the service gives you — here's why that matters.

Not sure whether a service supports it? Search the directory — we list which two-factor methods each of 2,500+ services offers, with step-by-step guides for the ones that work with an authenticator app.