How to Set Up Google Authenticator (and Back It Up Properly)

Last updated: October 8, 2026

Five stacked layers of backup for Google Authenticator codes, topped by a security shield

An authenticator app generates short-lived numeric codes on your phone. When you sign in to a protected account, you type your password and then the current code. Because the code changes every 30 seconds or so and never travels by text message, it is a stronger second step than SMS for most people.

Google Authenticator is one of the best-known apps for this. The setup takes a few minutes, but the part most people skip is the backup. If your phone is lost, broken or replaced and you have no backup plan, you can be locked out of the accounts you were trying to protect. This guide covers both.

How Authenticator Apps Work

When you enable app-based two-factor authentication on a website, the site shows a QR code (and usually a text "setup key"). That code contains a secret value shared between the site and your app. Both sides use that secret and the current time to calculate the same six-digit number. This is why the app works without an internet connection.

Both CISA and the FTC recommend turning on multi-factor authentication for important accounts, and an authenticator app is one of the most widely supported ways to do it.

The important consequence is that the secret lives in your app. If the app data disappears and you have no other way in, the website cannot recreate it for you. That is why backup and recovery codes matter.

Before You Begin

Install Google Authenticator from your phone's official app store (Google Play or the Apple App Store). Check that the publisher is Google.
Make sure your phone's clock is set to update automatically. Codes depend on accurate time. Google's help page notes that from version 7.0 the app no longer has its own time-correction setting and uses your phone's time setting instead.
Keep a second device or a computer nearby so you can scan a QR code shown on a screen.
Decide whether you will sign into the app with a Google account (see the sync section below).

Step-by-Step: Add Your First Account

Open the security settings of the account you want to protect. Look for wording such as "Two-factor authentication", "Two-step verification" or "Multi-factor authentication". The exact menu path depends on the service, so search its help pages if you cannot find it.
Choose "Authenticator app" as the method. Some services may call it "Authentication app" or "TOTP".
Open Google Authenticator and tap the plus button to add an account. Choose to scan a QR code.
Scan the QR code shown on the website using your phone camera. If you cannot scan (for example, you are on the same phone), choose "enter a setup key" and type the text key instead.
Confirm with the current code. The website asks you to type the six-digit code now displayed in the app. Enter it before it expires.
Save the recovery codes. Most services then show a set of backup codes. Store them right away (see below).
Test it. Open a private browser window, sign out and back in to confirm the code works. It is far better to find problems now than during an emergency.

Repeat for your most important accounts first: primary email, banking, cloud storage, social media and your password manager.

Backing Up Google Authenticator

There are several layers of protection. Use more than one.

Layer 1: Recovery codes from each service

These one-time codes are usually the most reliable safety net. When you enable two-factor authentication, download or copy the recovery codes and store them somewhere separate from your phone. A password manager's secure notes, a printed copy kept in a safe place at home, or both, are all reasonable choices. Do not leave them in an unprotected note on the same phone.

Layer 2: Google account sync in the app

Google Authenticator can sync your codes with your Google account. According to Google's Authenticator help page, you turn this on simply by signing in to your Google Account inside the app (version 6.0 or later on Android, 4.0 or later on iOS). When you sign in to the app on a new device with the same account, your codes sync to it automatically. That is convenient and helps if you lose your phone. The trade-off is that your codes are then tied to the security of that Google account, so it needs a strong password and its own robust two-factor protection. Google's help page says synced codes are encrypted in transit and at rest, but it does not describe them as end-to-end encrypted, and security researchers noted when the feature launched in 2023 that Google could technically read them. Check Google's current help pages to see whether that has changed. If you prefer not to sync, choose "Use without an account" in the app. Switching an already-synced app to that mode removes the codes from your Google account and leaves them on that device only, so make other backups first.

One important side effect of sync: Google's help page says that if your codes are synced to your Google Account, deleting a code on one device also deletes it from all devices where your codes are synced. Do not delete an entry to "tidy up" one phone unless you mean to remove it everywhere.

Layer 3: Transfer to a new phone

If you use the app without a Google Account and the old phone still works, you can move your codes manually. Google's help page describes the steps:

Install the latest Google Authenticator on both phones.
On the old phone, tap Menu → Transfer codes → Export codes (on iPhone: Transfer accounts → Export accounts). You will be asked to unlock the device.
Select the accounts to move and tap Next. If you move more than one account, the old phone may create more than one QR code.
On the new phone, tap Menu → Transfer codes → Import codes (or Scan QR code) and scan each QR code from the old phone.
Wait for the confirmation that the codes were transferred.

Google's help page uses slightly different wording by platform: on Android it is Transfer codes → Export codes / Import codes, and on iPhone it is Transfer accounts → Export accounts / Import accounts. Do this before you wipe or sell the old device. Treat that QR code as sensitive while it is displayed, because it contains your secrets. Do not screenshot it and leave it in your photo library.

Layer 4: A second authenticator entry

When you first set up an account, you can scan the same QR code into two separate devices at the same time, such as a phone and a tablet you keep at home. Both will generate the same codes. Once setup is finished, you cannot scan the same code again without resetting it, so do this during the initial setup.

Layer 5: Add a security key or passkey

Many major services let you register a physical security key or a passkey as a second option. That gives you a way in that does not depend on your phone. Our guide to passkeys explains how they work.

Google also suggests turning on Privacy Screen (Menu → Settings → Privacy Screen), which asks for your PIN, pattern or biometrics before the app opens.

Backup Methods Compared

Backup method	Protects against	Weakness
Recovery codes from each service	Lost, broken or stolen phone	Useless if lost or stored on the same phone; each code works once
Google Account sync	Lost phone, switching phones	Tied to your Google account's security; deleting a code deletes it everywhere
Manual export/transfer	Planned phone upgrades	Needs the old phone working; does not help after a sudden loss
Second device set up at the same time	Lost or broken main phone	Must be done during setup; the second device needs protecting too
Security key or passkey	Phone loss and phishing	Not every service supports it; you should own a spare key

Before You Reset, Sell or Trade In Your Old Phone

Run through this checklist while both phones are in your hands:

Open Google Authenticator on the new phone and confirm every account appears.
Sign in to your most important accounts (email first) using a code from the new phone. Do not assume a code works until you have tested it.
For any service that did not transfer, sign in with the old phone one last time and set up 2FA again on the new phone.
Check that your recovery codes are stored somewhere other than either phone.
Only then reset the old phone.

What to Do If You Lose Your Phone

Use your recovery codes or another registered method to sign into your most important accounts, such as email.
Where possible, remove the lost device and reset two-factor authentication on each account to a new authenticator setup.
Change passwords for anything sensitive, particularly if your phone was not locked with a PIN or biometrics.
If you had cloud sync enabled, sign in to Google Authenticator on the new phone with the same Google account to restore your codes. Google also suggests erasing the lost device remotely. If that is not possible and your codes were synced, you can remove the codes by removing the lost device from your Google Account; if they were not synced, you need to visit each site and reset 2FA there.
Where a website has a support process for lost second factors, expect identity checks. It can take time, which is why recovery codes are valuable.

Alternatives to Google Authenticator

Google Authenticator is not the only choice. Microsoft Authenticator, Authy, 2FAS, Aegis Authenticator on Android and Proton Authenticator are examples of other apps, each with its own way of handling backups and device changes. Password managers, including Bitwarden and 1Password, can also store and generate authenticator codes on some plans. Storing codes in the same place as your passwords is convenient but concentrates risk, so consider how that fits your threat level. Whatever app you choose, learn how its export and backup works before you need it. If you use a Google account, see how to recover a hacked Gmail or Google account before locking yourself out.

Common Mistakes to Avoid

Setting up two-factor authentication without saving recovery codes.
Deleting a code on one device without realizing sync removes it from all your devices.
Keeping the only copy of your codes on the same phone as the app.
Photographing setup QR codes and forgetting them in your gallery.
Entering a code into any page reached from an unexpected email or message. Phishing pages can relay your code in real time.
Wiping or trading in your old phone before moving your accounts.

Frequently Asked Questions

Do authenticator codes work offline?

Yes. They are calculated from a shared secret and the time on your phone, so no data connection is needed. Your phone's clock must be accurate.

Is an authenticator app safer than SMS?

Generally yes, because it avoids SIM-swap fraud and message interception. It is still not immune to phishing, since a fake site can ask for the code.

Can two phones show the same codes?

Yes, if both are set up using the same QR code or setup key, or via sync/export features.

What if a code keeps saying it is wrong?

Check that your phone's time is set automatically and that you are using the entry for the right account. Wait for a new code and try again.

If I delete a code on my old phone, will it disappear from my new one?

If your codes are synced to your Google Account, yes. Google says deleting a synced code removes it from all devices where your codes are synced.

Should I use the same app for every account?

It is simpler, yes. What matters is that your backup plan covers all of them.

Related Guides

Conclusion

Setting up Google Authenticator takes minutes, and it noticeably strengthens your important accounts. The part that separates a good setup from a fragile one is preparation: store recovery codes safely, decide deliberately about syncing, and know how to move to a new phone. Do the backup now, while everything works, so that losing a phone becomes an inconvenience rather than a lockout.

Search This Blog

Safe Sign In