Authenticator apps and security keys
Which authenticator app to pick, how security keys like YubiKey and Google Titan work, and how to back everything up so a lost phone never locks you out.
Codes versus keys
There are two main tools for strong two-factor authentication beyond text messages:
- Authenticator apps generate a six-digit code that changes every 30 seconds. This standard is called TOTP (time-based one-time password). The app and the website share a secret when you scan a QR code during setup, and both calculate the same code from the current time.
- Security keys are small physical devices that plug into a USB port or tap against your phone over NFC. They use the FIDO2 and WebAuthn standards, the same technology behind passkeys.
Authenticator codes are a big step up from SMS, but you can still be tricked into typing a code into a fake site. Security keys and passkeys are phishing-resistant: they check the real website address and will not respond to a look-alike.
Authenticator apps compared
| App | Cost | Backup and sync | Open source | Notes |
|---|---|---|---|---|
| Google Authenticator | Free | Optional sync to your Google account | No | Simple; also supports export by QR code |
| Microsoft Authenticator | Free | Cloud backup to your Microsoft account (iCloud on iPhone) | No | Also handles push sign-in for Microsoft accounts |
| Authy (Twilio) | Free | Encrypted cloud backup tied to your phone number | No | Desktop apps were discontinued in 2024; mobile only |
| Ente Auth | Free | End-to-end encrypted sync across devices | Yes | Works on phones, desktop and web |
| 2FAS | Free | Optional backup to iCloud or Google Drive | Yes | Clean design; browser extension for autofill |
Many password managers, including Apple Passwords, 1Password, Bitwarden (premium) and Proton Pass (paid), can also store authenticator codes. That is convenient, but it puts both factors in one place. For your most important accounts, many people prefer a separate app or a security key.
Whatever app you choose, make sure it has a backup or export option before you add dozens of accounts. Moving codes later is tedious if the app has no export.
Security keys
The best-known brands are YubiKey (from Yubico) and Google Titan. Most current models support USB-C or USB-A, many add NFC for phones, and some include a fingerprint reader. They work with Google, Microsoft and Apple accounts, password managers, social media platforms and many other services.
Why people use them:
- Phishing-resistant: the key checks the website's real domain before it answers.
- No battery and no network: nothing to charge, and nothing that depends on cell signal.
- Hard to steal remotely: an attacker needs the physical key and, for many setups, your PIN.
Downsides: they cost money, not every site supports them, and losing one without a backup can lock you out. Apple requires at least two keys before it lets you use them for an Apple Account.
Backup is not optional
The most common 2FA disaster is not hacking. It is a lost, broken or reset phone with no way back in. Before you rely on any method:
- Save backup codes for every account in your password manager or printed in a safe place at home.
- Register two methods where possible, for example an authenticator app plus a security key, or two security keys kept in different places.
- Turn on encrypted backup in your authenticator app, protected by a strong password.
- Test recovery on one account so you know the process works.
- Before trading in a phone, move your authenticator to the new device and confirm codes work there first.
Anyone who sees the setup QR code can generate your codes forever. Never screenshot it into a shared photo album, and never send it to anyone.
Which should you use?
- Most people: an authenticator app with encrypted backup, or passkeys where offered.
- Email, password manager and financial accounts: add passkeys or a pair of security keys.
- Anyone at high risk (public figures, administrators, people being targeted): two hardware keys, with account recovery options reviewed carefully.
Never share a code with anyone who calls or messages you asking for it. That request is a classic sign of phishing.
