How to Use an Authenticator App

An authenticator app adds a second layer of security to your online accounts by generating time-based, six-digit codes that you enter after your password. This guide walks you through installing, setting up, and using an authenticator app on your phone, so you can protect your email, bank, social media, and other accounts from unauthorized access. You’ll need your phone and access to the account you want to secure.

What You’ll Need

A smartphone (iOS or Android) with internet access to download the app.
The username and password for the account you want to protect.
Access to that account’s security or two-factor authentication (2FA) settings.
A backup method (like a recovery email or phone number) in case you get locked out.

Step-by-Step

Choose and install an authenticator app. Popular options include Google Authenticator, Microsoft Authenticator, Authy, and LastPass Authenticator. Download one from your phone’s official app store (App Store for iOS, Google Play for Android). Most are free.
Open the app and follow the initial setup. The first time you launch it, the app will usually ask for permission to send notifications (for login prompts) and may ask you to sign in to an account (like Google or Microsoft) to enable cloud backup. You can skip this if you prefer not to sync.
Go to the website or app of the account you want to secure. Log in with your normal username and password.
Find the security or two-factor authentication settings. Look for terms like “Security,” “Two-Factor Authentication,” “2FA,” “Login & Security,” or “Password & Security.” This is usually under your profile or account settings.
Select “Set up an authenticator app” or “Use an authenticator app.” The website will show a QR code (a square black-and-white pattern) and sometimes a manual setup key (a long string of letters and numbers).
In the authenticator app, tap the “+” or “Add account” button. Choose “Scan QR code” and point your phone’s camera at the QR code on your computer screen. If the QR code doesn’t scan, tap “Enter setup key” and type the manual key exactly as shown.
Wait for the app to add the account. You’ll see the account name (e.g., “GitHub”) and a six-digit code that refreshes every 30 seconds.
Enter the current six-digit code from the app into the website’s verification field. Do this within the 30-second window. If the code expires, wait for the next one and try again.
Confirm and save backup codes. Most sites will give you a set of one-time backup codes (usually 8â€“10 codes). Write them down or store them in a secure password manager. These are crucial if you lose your phone.
Finish the setup. The website will confirm that 2FA is enabled. From now on, after entering your password, you’ll be asked for a code from the authenticator app.

Common Mistakes

Deleting the app before disabling 2FA. If you remove the authenticator app without turning off 2FA on your accounts, you’ll be locked out. Always disable 2FA first or have backup codes ready.
Ignoring backup codes. Many people skip saving backup codes and later regret it when they lose their phone. Store them in a safe place.
Using the wrong code. The code changes every 30 seconds. Make sure you enter the code that is currently displayed, not one you saw a minute ago.
Scanning the QR code with the wrong camera. Some phones have multiple cameras; the app needs to see the QR code clearly. Hold the phone steady and ensure good lighting.
Not checking the time on your phone. Authenticator apps rely on your phone’s clock. If your time is off by more than a minute, codes won’t match. Enable automatic time sync.

Tips

Use an app that supports cloud backup. Apps like Authy or Microsoft Authenticator can back up your accounts, so you don’t lose them when you get a new phone. Google Authenticator now offers cloud sync too.
Set up 2FA on your most important accounts first. Prioritize email, banking, social media, and work accounts.
Keep your backup codes in a password manager. This way, they’re encrypted and accessible from multiple devices.
Add multiple devices if possible. Some apps let you add the same account to more than one phone, which is handy if you lose one.
Test your backup codes. After setting up, try using one backup code to log in. If it works, you know they’re valid.

Troubleshooting

Codes are not working. Check that your phone’s time is set to automatic. In your phone settings, go to Date & Time and enable “Set automatically.” If that doesn’t help, try resyncing the app (in Google Authenticator, go to Settings > Time correction for codes).
Lost your phone? Use a backup code to log in. If you don’t have backup codes, contact the website’s support. Most services have a recovery process (e.g., sending a code to your email or phone).
QR code won’t scan. Try the manual setup key. Make sure there are no extra spaces or characters. Also, clean your camera lens and increase screen brightness.
App won’t add the account. If you already added the account before, you might see a duplicate. Delete the old entry first. If the issue persists, restart the app or your phone.
You’re locked out of the account. Use a backup code, a recovery email, or contact the service’s support team. Be prepared to verify your identity with personal questions or a government ID.

Frequently Asked Questions

What if I get a new phone?

If your authenticator app has cloud backup, restore your accounts on the new phone by signing into the same account. Otherwise, you’ll need to disable 2FA on each website using your backup codes or old phone, then set it up again on the new phone.

Can I use the same authenticator app for multiple accounts?

Yes, absolutely. An authenticator app can store many accounts. Just tap “+” to add each one. This is actually recommended, as it keeps all your codes in one place.

Is an authenticator app safer than SMS codes?

Generally, yes. SMS codes can be intercepted through SIM swapping or phishing. Authenticator apps generate codes locally on your device, so they’re not sent over the network, making them more secure.

What if I accidentally delete the authenticator app?

If you have backup codes, use them to log in and then disable 2FA. If you have cloud backup, you can reinstall the app and restore your accounts. If neither, you’ll need to contact each service’s support to verify your identity and reset 2FA.

Do I need an internet connection to get codes?

No. Authenticator apps generate codes using a time-based algorithm, so they work offline. You only need internet to set up the account or when you log in (to access the website).

Can I use the same account on two phones?

Yes, many authenticator apps allow you to add the same account to multiple devices. During setup, you can scan the QR code with both phones. However, not all services support this, so check your app’s documentation.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →