Short answer: An authenticator app is a small program on your phone that generates a fresh six-digit code every 30 seconds for each account you have added to it. It does this entirely offline, using a secret key stored on your device and the current time. When a website asks for your code, you open the app and read the number. No internet, no text messages, nothing sent anywhere.
If you have ever wondered why the code changes while you are typing it, or why the app works in aeroplane mode, this is the explanation.
The problem it solves
Passwords fail in predictable ways. They get reused across sites, leaked in breaches you never hear about, guessed, or typed into a convincing fake login page. Any one of those hands an attacker everything they need.
An authenticator app adds a second requirement: proof that you are holding a specific physical device. Someone in another country with your password still cannot get in, because the code lives on the phone in your pocket.
That is the whole idea behind two-factor authentication — one thing you know, one thing you have.
How it actually works
The mechanism is simpler than most people expect.
At setup: the website generates a random secret key and shows it to you as a QR code. You scan it, and your app stores that secret. Now two parties know it — the website’s server and your phone. It never travels again.
Every 30 seconds: your app takes the secret, combines it with the current time, and runs both through a standard cryptographic function. The result gets shortened into six digits.
When you log in: the server does the exact same calculation with its own copy of the secret. If its answer matches what you typed, you are in.
Nothing is transmitted. Both sides simply arrive at the same number because they started with the same inputs. That is why the app works with no signal, no SIM and no data — it is doing arithmetic, not fetching anything.
The standard is called TOTP, and we cover the mechanics in more depth in what is a TOTP code and TOTP vs HOTP.
Why any app works with any website
This confuses a lot of people. A site says “use Google Authenticator”, so they install Google Authenticator specifically — then panic when they want to switch apps.
TOTP is an open, published standard. Every authenticator implements the same algorithm. When a site says “Google Authenticator”, read it as “any authenticator app”. Google Authenticator, Authy, Microsoft Authenticator, Aegis, 2FAS, Ente Auth, or a password manager with TOTP built in — all produce identical codes from the same secret.
The one notable exception is Steam, which uses its own five-character variant — covered in our Steam Guard guide.
What an authenticator app is not
A few things people reasonably assume, and shouldn’t:
- It is not sending you the code. The code is calculated locally. Nobody texts it, emails it, or pushes it to you.
- It does not know your password. The app has no idea what your account password is, and cannot log in for you.
- It is not a password manager — though some password managers include the function. See password managers with built-in TOTP.
- It does not sync automatically unless the app offers that feature and you turned it on. This trips up a lot of people when they change phones.
Getting started, in four steps
- Install an app. 2FAS and Ente Auth are excellent free choices; Google Authenticator and Microsoft Authenticator are fine too. Our picks: best 2FA apps for iPhone and Aegis vs 2FAS for Android.
- Turn on 2FA at a website. Start with your email — it is the reset path for everything else. Guides: Google, Microsoft.
- Scan the QR code with your app and enter the six digits to confirm. If you cannot scan — because the code is on the same phone — use the text key instead: manual setup key entry.
- Save the backup codes the site gives you, somewhere offline. This is the step people skip and later regret: where to store backup codes.
The one thing to get right from day one
Back it up. Not because of hackers — because of taxis, swimming pools, and phone upgrades.
If every code lives on one device with no backup, losing that device locks you out of everything at once. Either use an app with encrypted cloud sync, keep an encrypted export file, or scan each QR code into two devices while it is on screen. Full method: how to back up your authenticator app.
Frequently asked questions
Does an authenticator app work without internet?
Yes, completely. No data, no Wi-Fi, no SIM required. The code is calculated on the device from the stored secret and the clock.
What happens if I delete the app?
The secrets go with it, and you will need backup codes to get into your accounts. Some apps restore from cloud backup; most do not unless you enabled it. Check before you uninstall anything.
Is an authenticator app safer than SMS codes?
Yes. SMS codes travel through the phone network, where an attacker can hijack your number without touching your phone — see SIM swap attacks and SMS vs authenticator apps.
Why does my code get rejected?
Usually your phone’s clock has drifted. Turn on automatic network time. Other causes: why 2FA codes get rejected.
Can I use the same app for all my accounts?
Yes, and most people do. One app holding twenty accounts is normal — just make sure it is backed up.
Is anything stronger than an authenticator app?
Passkeys and hardware security keys, because they cannot be phished. Where a site offers them, take them; keep the app for everywhere else. See passkeys vs 2FA.
The bottom line
An authenticator app is a tiny offline calculator that proves you are holding your phone. It takes two minutes to install, works without a network, and stops the single most common way accounts are stolen. The only real discipline it asks of you is a backup — sort that out on day one and the rest takes care of itself.
Want to see a code generated right now? Our free online 2FA code generator runs entirely in your browser, and we explain when browser-based tools are appropriate in is an online 2FA generator safe?
2 Responses