Best Authenticator App Options: Google, Microsoft, Authy

Text-message codes are better than nothing, but an authenticator app is a step up. It generates short-lived codes on your device, so a thief cannot read them from a stolen text or a hijacked phone number. The harder question is which app to pick, because the differences that matter are not about looks. They are about what happens when you lose or replace your phone.

This guide compares four popular choices: Google Authenticator, Microsoft Authenticator, the Passwords app built into Apple devices, and Authy. It explains what to check before you commit and how to avoid getting locked out. Features change, so check each vendor's help page for current details.

Why an Authenticator App Beats Text Messages

The Cybersecurity and Infrastructure Security Agency (CISA) describes multifactor authentication (MFA) as a way to protect your accounts even if a password is stolen. It lists text messages, authenticator apps that produce a new code every 30 seconds, and biometrics as options. CISA also says not all MFA is equally strong. Its fact sheet ranks phishing-resistant MFA, meaning FIDO/WebAuthn security keys and similar, as the strongest, calling it the gold standard. App-based authenticators come next and are a good option when phishing-resistant MFA is not available, though they can still be phished. CISA places SMS and voice codes last, says they should be a last resort, and notes they are vulnerable to phishing, SS7 attacks and SIM swaps. CISA's message is also that any MFA is better than none. Our article on SMS versus app versus security key explains the trade-offs in detail.

A main reason text codes rank lowest is that your phone number can be hijacked through a SIM swap, which CISA lists among the threats to MFA. See our guide to SIM swap attacks for how to protect your number.

What to Look for in an Authenticator App

1. A recovery plan. If your phone is lost, stolen or broken, can you restore your codes on a new device? This is the most important difference between apps.
2. A lock on the app itself. A PIN, pattern or biometric prompt means a thief holding your unlocked phone cannot simply open your codes.
3. Support for the standard code system. Most websites use standard time-based codes. Any mainstream app handles them.
4. Clear export and transfer options, so you are not stuck with one app forever.

Google Authenticator

Google's help pages say the app can generate one-time verification codes without internet access or mobile service. It can also sync your codes to a Google Account, so that signing in to the app on a new device restores them. Google says the codes are encrypted in transit and at rest when synced.

Google also lets you use the app without an account, in which case the codes stay on the device, and describes a manual transfer method with QR codes from the old device to the new one. It offers a Privacy Screen setting that requires a PIN, pattern or biometric check before the app opens.

Good for: people who already use a Google Account and want a simple app. Watch out for: if you use the app with a Google Account, Google recommends enrolling in other forms of 2-Step Verification so you cannot lock yourself out. If you delete a synced code, it is removed on all devices.

Microsoft Authenticator

Microsoft Authenticator supports both one-time codes for other services and sign-in approvals for Microsoft accounts. Microsoft's support page says you can back up your accounts so you can restore them on a new phone, but with limits: backup and restore works only on the same device type, so an iOS backup cannot be restored on Android. On iOS it relies on iCloud Drive, iCloud Keychain and iCloud Backup being on. On Android it uses a Microsoft personal account, and Microsoft says that starting in January 2027 Android backup will move to Google One backup. Microsoft explains how to back up your accounts in Microsoft Authenticator.

Microsoft also notes that for work or school accounts, only the account name is backed up, so you must sign in again after restoring.

Good for: people whose email and work tools are in the Microsoft ecosystem. Watch out for: switching from iPhone to Android can mean re-adding accounts manually, so keep recovery codes handy.

Apple's Passwords App

Apple's Passwords app can store passwords and passkeys and, according to Apple's documentation, generate verification codes. To add one, Apple says to open Passwords, choose the account, and under Security choose Set Up Verification Code. iCloud Keychain keeps your passwords and passkeys available on your approved Apple devices. Apple says the feature lets you use two-factor authentication without relying on SMS messages or additional apps, which is the convenience.

Good for: households that use only Apple devices. Watch out for: keeping your password and your code in the same place is convenient, but it reduces the separation between the two factors if someone gets into that one account. Protect your Apple Account with a strong, unique password, two-factor authentication and a device passcode, and keep the recovery options current. Also consider how you would move the codes if you leave the Apple ecosystem.

Authy

Authy, from Twilio, is a long-running authenticator that has been popular with people who switch phones often. Twilio announced that the Authy desktop apps for Windows, macOS and Linux would reach end of life on March 19, 2024, so plan on using it on a phone. Twilio's developer documentation still describes the Authy app as a free app for time-based one-time passcodes, but it also says the Authy API is closed to new customers and will be fully deprecated in the future. That notice concerns businesses building on the API, and Twilio has not announced an end date for the consumer app that we could verify. Check Twilio's current Authy pages and your app store listing before choosing it for the long term.

Good for: people who already use it and have confirmed how its backup works. Watch out for: product roadmaps can change, so confirm it is still supported before moving all your accounts there.

Other Options

Many password managers, including Bitwarden and 1Password, include built-in code generators, and so do some other security apps. They can be convenient, but the same caution applies: if a single vault holds your password and your codes, guard that vault with a long master password and its own two-factor authentication.

A Sensible Way to Choose

• Mostly Google services on Android: Google Authenticator with account sync turned on.
• Microsoft-centered life or workplace: Microsoft Authenticator, with cloud backup enabled.
• All Apple devices: the Passwords app is convenient, with strong Apple Account protection.
• Switching platforms often: choose an app with clear export or encrypted backup, and save recovery codes.

Whatever you choose, do not rely on the app alone.

Setup Steps That Prevent Lockouts

1. Go to the account's security settings and look for two-step verification or MFA. CISA suggests looking under Account Settings, Security or similar names.
2. Choose the authenticator app option and scan the QR code. If the site offers a text setup key, save it in your password manager.
3. Type in the first code to confirm it works.
4. Save the backup or recovery codes the site provides, and store them somewhere other than the same phone.
5. Turn on the app's own lock, and enable the backup or sync feature.
6. Keep at least one additional way to get in, such as a second device or a security key.

Our guide to setting up Google Authenticator and backing it up walks through each step.

Frequently Asked Questions

Are authenticator apps unhackable?

No. They protect against stolen passwords and intercepted texts, but CISA notes that app-based codes can still be phished: a fake login page can trick you into typing a code. CISA says FIDO/WebAuthn security keys resist that, and Apple says passkeys are less vulnerable to phishing.

What if I lose my phone?

Use the app's backup or sync, or the recovery codes you saved, to regain access and then re-enroll the codes on the new phone.

Should I keep SMS turned on too?

Some sites keep SMS as a backup. Remove it where you can, since an attacker may choose the weakest route.

Are free apps enough?

For most people, a mainstream app from a known vendor is enough. Check each vendor's current terms, since plans and features can change.

Related Guides

• Security Keys Explained: Do You Need a YubiKey?
• How to Set Up Google Authenticator (and Back It Up Properly)
• How to Check Which Devices Have Access to Your Account

Conclusion

Any mainstream authenticator app is a real improvement over text codes. What separates them is recovery: choose the one whose backup and transfer options fit the phones you use, lock it with a PIN or biometrics, and save your recovery codes. Then turn on app-based codes for your email, bank and other key accounts first.

Text-message codes are better than nothing, but an authenticator app is a step up. It generates short-lived codes on your device, so a thief cannot read them from a stolen text or a hijacked phone number. The harder question is which app to pick, because the differences that matter are not about looks. They are about what happens when you lose or replace your phone.

This guide compares four popular choices: Google Authenticator, Microsoft Authenticator, the Passwords app built into Apple devices, and Authy. It explains what to check before you commit and how to avoid getting locked out. Features change, so check each vendor's help page for current details.

Why an Authenticator App Beats Text Messages

The Cybersecurity and Infrastructure Security Agency (CISA) describes multifactor authentication (MFA) as a way to protect your accounts even if a password is stolen. It lists text messages, authenticator apps that produce a new code every 30 seconds, and biometrics as options. CISA also says not all MFA is equally strong. Its fact sheet ranks phishing-resistant MFA, meaning FIDO/WebAuthn security keys and similar, as the strongest, calling it the gold standard. App-based authenticators come next and are a good option when phishing-resistant MFA is not available, though they can still be phished. CISA places SMS and voice codes last, says they should be a last resort, and notes they are vulnerable to phishing, SS7 attacks and SIM swaps. CISA's message is also that any MFA is better than none. Our article on SMS versus app versus security key explains the trade-offs in detail.

A main reason text codes rank lowest is that your phone number can be hijacked through a SIM swap, which CISA lists among the threats to MFA. See our guide to SIM swap attacks for how to protect your number.

What to Look for in an Authenticator App

1. A recovery plan. If your phone is lost, stolen or broken, can you restore your codes on a new device? This is the most important difference between apps.
2. A lock on the app itself. A PIN, pattern or biometric prompt means a thief holding your unlocked phone cannot simply open your codes.
3. Support for the standard code system. Most websites use standard time-based codes. Any mainstream app handles them.
4. Clear export and transfer options, so you are not stuck with one app forever.

Google Authenticator

Google's help pages say the app can generate one-time verification codes without internet access or mobile service. It can also sync your codes to a Google Account, so that signing in to the app on a new device restores them. Google says the codes are encrypted in transit and at rest when synced.

Google also lets you use the app without an account, in which case the codes stay on the device, and describes a manual transfer method with QR codes from the old device to the new one. It offers a Privacy Screen setting that requires a PIN, pattern or biometric check before the app opens.

Good for: people who already use a Google Account and want a simple app. Watch out for: if you use the app with a Google Account, Google recommends enrolling in other forms of 2-Step Verification so you cannot lock yourself out. If you delete a synced code, it is removed on all devices.

Microsoft Authenticator

Microsoft Authenticator supports both one-time codes for other services and sign-in approvals for Microsoft accounts. Microsoft's support page says you can back up your accounts so you can restore them on a new phone, but with limits: backup and restore works only on the same device type, so an iOS backup cannot be restored on Android. On iOS it relies on iCloud Drive, iCloud Keychain and iCloud Backup being on. On Android it uses a Microsoft personal account, and Microsoft says that starting in January 2027 Android backup will move to Google One backup. Microsoft explains how to back up your accounts in Microsoft Authenticator.

Microsoft also notes that for work or school accounts, only the account name is backed up, so you must sign in again after restoring.

Good for: people whose email and work tools are in the Microsoft ecosystem. Watch out for: switching from iPhone to Android can mean re-adding accounts manually, so keep recovery codes handy.

Apple's Passwords App

Apple's Passwords app can store passwords and passkeys and, according to Apple's documentation, generate verification codes. To add one, Apple says to open Passwords, choose the account, and under Security choose Set Up Verification Code. iCloud Keychain keeps your passwords and passkeys available on your approved Apple devices. Apple says the feature lets you use two-factor authentication without relying on SMS messages or additional apps, which is the convenience.

Good for: households that use only Apple devices. Watch out for: keeping your password and your code in the same place is convenient, but it reduces the separation between the two factors if someone gets into that one account. Protect your Apple Account with a strong, unique password, two-factor authentication and a device passcode, and keep the recovery options current. Also consider how you would move the codes if you leave the Apple ecosystem.

Authy

Authy, from Twilio, is a long-running authenticator that has been popular with people who switch phones often. Twilio announced that the Authy desktop apps for Windows, macOS and Linux would reach end of life on March 19, 2024, so plan on using it on a phone. Twilio's developer documentation still describes the Authy app as a free app for time-based one-time passcodes, but it also says the Authy API is closed to new customers and will be fully deprecated in the future. That notice concerns businesses building on the API, and Twilio has not announced an end date for the consumer app that we could verify. Check Twilio's current Authy pages and your app store listing before choosing it for the long term.

Good for: people who already use it and have confirmed how its backup works. Watch out for: product roadmaps can change, so confirm it is still supported before moving all your accounts there.

Other Options

Many password managers, including Bitwarden and 1Password, include built-in code generators, and so do some other security apps. They can be convenient, but the same caution applies: if a single vault holds your password and your codes, guard that vault with a long master password and its own two-factor authentication.

A Sensible Way to Choose

• Mostly Google services on Android: Google Authenticator with account sync turned on.
• Microsoft-centered life or workplace: Microsoft Authenticator, with cloud backup enabled.
• All Apple devices: the Passwords app is convenient, with strong Apple Account protection.
• Switching platforms often: choose an app with clear export or encrypted backup, and save recovery codes.

Whatever you choose, do not rely on the app alone.

Setup Steps That Prevent Lockouts

1. Go to the account's security settings and look for two-step verification or MFA. CISA suggests looking under Account Settings, Security or similar names.
2. Choose the authenticator app option and scan the QR code. If the site offers a text setup key, save it in your password manager.
3. Type in the first code to confirm it works.
4. Save the backup or recovery codes the site provides, and store them somewhere other than the same phone.
5. Turn on the app's own lock, and enable the backup or sync feature.
6. Keep at least one additional way to get in, such as a second device or a security key.

Our guide to setting up Google Authenticator and backing it up walks through each step.

Frequently Asked Questions

Are authenticator apps unhackable?

No. They protect against stolen passwords and intercepted texts, but CISA notes that app-based codes can still be phished: a fake login page can trick you into typing a code. CISA says FIDO/WebAuthn security keys resist that, and Apple says passkeys are less vulnerable to phishing.

What if I lose my phone?

Use the app's backup or sync, or the recovery codes you saved, to regain access and then re-enroll the codes on the new phone.

Should I keep SMS turned on too?

Some sites keep SMS as a backup. Remove it where you can, since an attacker may choose the weakest route.

Are free apps enough?

For most people, a mainstream app from a known vendor is enough. Check each vendor's current terms, since plans and features can change.

Related Guides

• Security Keys Explained: Do You Need a YubiKey?
• How to Set Up Google Authenticator (and Back It Up Properly)
• How to Check Which Devices Have Access to Your Account

Conclusion

Any mainstream authenticator app is a real improvement over text codes. What separates them is recovery: choose the one whose backup and transfer options fit the phones you use, lock it with a PIN or biometrics, and save your recovery codes. Then turn on app-based codes for your email, bank and other key accounts first.