Short answer: Install the Steam mobile app, sign in, open the Steam Guard menu and tap Add Authenticator. Confirm your phone number, enter the SMS code, and — critically — write down the recovery code beginning with R before you tap past it. Steam Guard uses its own five-character codes, so a standard authenticator app will not work out of the box.
Why Steam accounts are stolen constantly
A Steam account is a wallet. It holds a game library that may represent years of purchases, a Steam Wallet balance, and — on trading-heavy games — an inventory of items with real market value. CS and Dota skins routinely change hands for hundreds of dollars.
The attack does not usually start with your password. It starts with a message from a “friend” asking you to vote for their tournament team, or a fake trading site, or a Discord link. You sign in on a lookalike page, your session is relayed, and your inventory is emptied within minutes. Trades are irreversible.
Steam Guard on mobile is the single control that turns this from routine into difficult — and it is also what unlocks normal trading in the first place.
Step 1: Install the Steam mobile app
Download the official Steam app from the App Store or Google Play. Check the publisher is Valve Corporation — fake Steam apps exist and their entire purpose is to harvest logins.
Sign in with your account. You will likely have to confirm via an email code, since Steam Guard email protection is on by default.
Step 2: Add the authenticator
- Tap the menu (☰) and open Steam Guard.
- Tap Add Authenticator.
- Enter your phone number and tap Add Phone. A number is mandatory here.
- Enter the code Steam texts you.
Steam then activates the mobile authenticator and displays your recovery code.
Step 3: Save the R-code — this is the important part
Steam shows a recovery code in the format R-XXXXX. It is displayed once, at setup, and it is your only self-service route back in if you lose the phone.
Write it on paper. Photograph the paper, not the screen, and keep it somewhere physical. Or store it in an encrypted password manager vault. Do not screenshot it into a camera roll that syncs to a cloud account, and do not leave it in a note on the same phone that holds the authenticator — that defeats the purpose.
Without it, recovery means Steam Support, proof of purchase records, and a wait of several days during which your account is unusable. Our guide on where to store backup codes safely applies here directly, and recovering accounts after losing your 2FA phone covers the wider process.
Step 4: Understand the trade hold
Steam deliberately restricts trading for the first 15 days after you enable the mobile authenticator. Items you trade or sell during that window sit in a hold before completing.
This is not a bug and support will not waive it. It exists so that an attacker who compromises an account and adds their own authenticator cannot immediately liquidate the inventory — it gives the real owner time to notice.
The implication: if you plan to trade, enable the authenticator now, not the day before. And if you ever have to remove and re-add the authenticator, the 15-day clock restarts.
Step 5: Turn on the extra protections
Two things worth doing immediately afterwards, both in the app or on the Steam website:
- Confirmations — with the mobile authenticator active, every trade and market listing must be approved in the app. Never approve one you did not initiate. Attackers rely on people tapping confirm reflexively.
- Deauthorise all devices — under Account details → Manage Steam Guard, remove remembered devices. Old browsers and shared PCs hold long-lived sessions that bypass the login screen entirely.
Also worth checking: Account details → Licenses and product key activations and your email address on file. If an attacker has already been in the account, changing the email is usually their first move.
Can you use Google Authenticator or Aegis with Steam?
Not through the normal setup flow, no. Steam uses a variant of the standard TOTP algorithm that produces five-character alphanumeric codes instead of six digits, and it does not offer a QR code for third-party apps. The official route is the Steam mobile app.
Some authenticator apps — Aegis, 2FAS, Authy and others — do support a “Steam” token type. Using it requires extracting the secret from the app data, which typically means a rooted or jailbroken device or a third-party desktop tool. Both are meaningful risks:
- Third-party “Steam Desktop Authenticator” tools have been repeatedly cloned into malware that steals the secret it is supposed to protect.
- Extracting the secret puts it in a file that can be stolen — and anyone holding it owns your second factor permanently.
Unless you have a specific reason and know exactly what you are doing, use the official app. For every other service, a standard authenticator remains the right tool — see how TOTP codes work and our roundup of the best authenticator apps.
Frequently asked questions
What if I lose my phone?
Use the R-code: on the Steam login screen choose “I no longer have access to my mobile authenticator” and enter it. No code means Steam Support, identity verification through purchase history, and a wait. Re-adding the authenticator then restarts the 15-day trade hold.
Can I have Steam Guard on two phones?
No. Steam allows one active mobile authenticator per account. Moving to a new phone means removing it from the old device (or using the recovery code) and adding it again — with the trade hold reset that follows.
Why are my Steam codes five characters instead of six digits?
Steam uses a modified TOTP alphabet that includes letters. The underlying time-based mechanism is the same as any other authenticator; only the encoding of the output differs.
Why does Steam say my code is wrong?
Usually clock drift between your phone and Steam’s servers. Turn on automatic network time in your date and time settings, and use the app’s built-in time-sync option under Steam Guard settings. See why 2FA codes get rejected.
Is Steam Guard email protection enough on its own?
No. Email codes protect against a stolen password but not against a compromised email account, and they do not unlock full trading privileges. The mobile authenticator is the real control.
Someone traded away my items — can I get them back?
Almost never. Steam trades are final by design, and support does not restore traded items. This is exactly why the mobile authenticator and its confirmation step exist. If it has happened, change your password, deauthorise all devices, run a malware scan on your PC — session cookie theft is a common vector — and check your email account for forwarding rules an attacker may have added.
The bottom line
Steam Guard is straightforward, but two details decide how much good it does: writing down the R-code before you dismiss it, and never approving a confirmation you did not start yourself. Add it well before you need to trade, because the 15-day hold does not negotiate.
Securing the rest of your accounts too? Start with our complete guide to two-factor authentication, or read how attackers get past 2FA to understand what you are defending against.
2 Responses