What Authentication App Should You Use? A Plain Guide

An authentication app is a small program on your phone that proves it’s really you signing in. It does this by showing a short code that changes every 30 seconds or so, or by asking you to approve a sign-in with a tap. The right one for you is an app that works with the accounts you care about, lets you back up your codes, and stays out of your way. This guide explains how these apps work, how to set one up, what to do when you change phones, and how to remove one without locking yourself out.

TL;DR

• An authentication app is a second step after your password. It generates a one-time code (or a push prompt) that only your device can produce.
• It beats text-message codes because it can’t be intercepted through a SIM swap, according to the FTC.
• Turn it on first for your main email, bank and health accounts, then for everything else that offers it.
• Pick an app with encrypted backup or transfer, so a lost phone doesn’t mean a lost account.
• Before removing an app, switch the account to another method first. Deleting the code entry alone can lock you out.

What an authentication app does

An authentication app, also called an authenticator app, sits on your phone or tablet. When you log in to an account, the site asks for something beyond your password. The app supplies it. The U.S. Federal Trade Commission describes it as a way to verify that it’s you trying to log in, either by generating a passcode or by sending a login-approval notification.

That is the whole idea behind two-factor authentication (2FA). Your password is something you know. The app is something you have. An attacker who steals your password from a breached site still can’t sign in, because they don’t have your phone.

People search for this in a few different ways. “What is my authentication app?” usually means “which app is already holding my codes?” Check your phone’s home screens and app library for a code-generating app, or look in your password manager, since many include one. “What does it mean to authenticate an app?” is a different question: it can mean approving a new device or linking a service to an account. This guide focuses on the first meaning: the app that proves you are you.

How authentication apps work

There are two common behaviors, and many apps do both.

Time-based codes

The most common type produces a time-based one-time password, or TOTP. OWASP’s multifactor authentication guidance explains the flow. When you set it up, the service shows a QR code. You scan it with the app. From then on, the app generates a numeric code from a shared secret and the current time, using a fixed time step. The standard behind it, RFC 6238, recommends 30 seconds as the default.

Two things follow from this:

• It works offline. The code comes from the secret and the clock, not from a network connection. Airplane mode is fine.
• It works across apps. Because TOTP is a standard, a compliant app can work with many compatible services, as OWASP notes. You are not locked to one vendor’s app for each site.

The flip side: the secret in that QR code is the key to your second factor. Anyone who copies it can generate your codes. Treat the QR code during setup like a password, and don’t screenshot it and leave it in your photos.

Push approvals

Some apps skip the typing. Instead, the service sends a push notification with the details of the login attempt, and you approve or deny it with a tap. It’s faster than copying six digits. The risk is habit: if you tap “approve” on a prompt you didn’t start, you’ve let someone in. If a prompt appears when you’re not signing in, deny it and change that account’s password.

Authentication app vs. text message codes vs. passkeys

You’ll see three options on most security settings pages. Here is how they compare.

The FTC states that an authenticator app is safer than SMS or email codes because the passcode isn’t susceptible to SIM-swap attacks or someone hacking your email. That doesn’t make SMS useless. A text code is far better than no second factor. But when a site offers a choice, take the app.

Passkeys and passwordless sign-in go a step further by removing the password itself. They are growing, but you’ll still need codes for the many sites that haven’t adopted them. For now, an authentication app is the practical middle ground. If you want to see where passwordless is heading, our passwordless QR code login page shows one approach.

Which accounts to protect first

No need to do everything in one afternoon. NIST advises turning on multifactor authentication whenever possible, especially for sensitive accounts such as your primary email, financial accounts and health records.

A sensible order:

1. Primary email. It’s the reset path for almost every other account. Whoever controls it controls the rest.
2. Banking, brokerage and payment apps.
3. Health portals and insurance.
4. Your password manager and cloud storage.
5. Social media and shopping accounts.

If you run a business, the bar is higher. OWASP recommends requiring some form of MFA for all users, and requiring it for administrators and other high-privilege accounts. Start with admin consoles, email, payroll and anything that touches customer data.

How to set up an authentication app

The steps are nearly the same everywhere. Login.gov, the U.S. government’s sign-in service, shows the pattern: you sign in, select “Enable” next to “Authentication app,” then scan the code or enter it to associate the app with your account. After that, you use the app’s one-time passcodes to sign in.

A general walkthrough:

1. Install an authentication app from your phone’s official app store.
2. Open the account’s security settings on a computer or second screen. Look for “two-step verification,” “two-factor authentication” or “authenticator app.”
3. Choose the authenticator option. The site shows a QR code and often a text setup key.
4. Scan the QR code in the app. If you can’t scan, type the setup key by hand.
5. Enter the six-digit code the app shows to confirm the pairing.
6. Save the recovery codes the site gives you. Store them somewhere other than your phone, such as in an encrypted vault or a printed copy in a safe place.

That last step is the one people skip, and it’s the one that saves you later.

If you use LogMeOnce, our support team keeps a step-by-step setup guide for TOTP apps that covers using a standard code-generating app with your LogMeOnce account.

What to look for when choosing an app

There is no single best app for everyone. Compare on these points instead.

Backup and transfer. This matters most. Many apps let you store optional backups of your codes online, so you can get them back on a new phone. Without a backup, a lost phone means going through each site’s recovery process one by one. Check that the backup is encrypted and protected by a strong passphrase.

Standard TOTP support. If an app follows the TOTP standard, you can move your codes later. A proprietary-only app can trap you.

Lock screen or biometric lock. Anyone who picks up your unlocked phone shouldn’t be able to open your codes. Look for a PIN, fingerprint or face unlock on the app itself.

Multi-device support. If you use a phone and a tablet, or want a spare device as a fallback, check that the app can sync or export safely.

Privacy. Read what data the app collects. A code generator has little reason to need your contacts or location.

Where it lives. You have three broad types to choose from:

• A standalone authenticator from a device or platform maker.
• An open-source authenticator with no account or cloud.
• An authenticator built into a password manager, so codes and logins sit in one encrypted vault.

The third type is the most convenient, but it puts more eggs in one basket. If you go that route, protect the vault with a long master password and its own second factor.

Perspective: where authentication apps fall short

We build identity security software, and we’ll be straight about this: an authentication app is a big improvement over a password alone, but it is not the finish line.

The weak spots are human ones. People approve prompts they didn’t start. They lose the phone with no backup. They scan a QR code during setup and leave a screenshot in their camera roll. And a convincing fake login page can still trick you into typing a valid code, which the attacker then uses within the 30-second window.

That’s why we put weight on passwordless sign-in. When there is no password to steal and the login is tied to your device and your biometrics, whole families of attacks stop working. Our passwordless login, which uses a QR code scanned from your phone, is built around that idea. We also support standard TOTP, so you can use a code-generating app with your account if that suits you better.

Our advice for most readers: use an authentication app today on every account that offers one, keep recovery codes offline, and move to passwordless options where they exist. Don’t wait for a perfect setup. A decent one that you actually turn on beats an ideal one you never get to.

— Mike

Using one password manager for passwords and second factors

If you’re setting up an authentication app for the first time, it helps to decide where your passwords live too. Running a password manager and an authenticator side by side means fewer logins to remember and fewer chances to reuse a weak password.

LogMeOnce offers a password manager with a free Premium plan at $0.00 per month, plus paid personal tiers: Professional at $2.50 per month, Ultimate at $3.25 per month and Family at $4.99 per month. For small teams, Teams is $4.00 per month per user and Business is $7.99 per month per user. Enterprise plans have no published price. You can compare the tiers on our password manager plans page and see everything we offer on the LogMeOnce resources hub.

If you’d also like to know whether your email addresses have turned up in known leaks, our identity theft protection page explains dark web monitoring. Business buyers can see per-user options on the business pricing and comparison page.

Moving to a new phone without losing access

This is where most authenticator trouble begins. Do the work before you trade in or reset the old device.

1. Don’t wipe the old phone yet. Keep it until every account works on the new one.
2. Use your app’s transfer or backup feature, if it has one. Restore on the new phone and test each code.
3. If there is no transfer feature, go account by account: on the old phone, open the account’s security settings, add the new phone as a fresh authenticator, confirm, then remove the old entry.
4. Keep recovery codes handy. If something fails, those codes get you in.
5. Test your most important accounts first: email, bank, password manager.

If your phone is already lost, use each site’s recovery path. Have your recovery codes ready. If you didn’t save any, expect identity checks, and start with your email account since it unlocks the rest. Then set up a backup before you do anything else.

How to remove an authentication app from an account

People ask this after they change phones, switch apps, or want a different method. The safe order matters.

1. Sign in to the account on a trusted device, using your current second factor.
2. Open security settings and find two-step verification or authenticator app.
3. Switch to a replacement first: add a new authenticator, a passkey, or a security key. If you really want to turn the feature off, the site’s own settings will say how, and many services warn that this makes the account weaker.
4. Remove or disable the old authenticator on the site’s side.
5. Only then delete the entry inside the app (often a swipe or long press on the code).

The common mistake is deleting the code inside the app first. The site still expects a code, and now you have none. If that happens, you’ll need a recovery code or the site’s account recovery process.

And think twice before turning 2FA off entirely. The Wirecutter security guide argues that you shouldn’t turn off two-factor authentication and suggests keeping a backup of your codes instead. If the problem is a hassle, change the method, don’t remove the protection.

Common mistakes to avoid

• Approving prompts you didn’t trigger. A surprise prompt means someone has your password. Deny it and change the password.
• Keeping recovery codes only on the phone. If the phone is gone, so are the codes.
• Screenshotting setup QR codes. That image is your secret. Delete it or store it in an encrypted vault.
• Using the app for some accounts but SMS for your email. Your email is the master key. Give it the strongest option.
• Typing a code into a page you reached from a link. Go to the site yourself, then sign in.
• Relying on one device. Have a backup plan before something breaks.

FAQ

What is an authentication app used for?

It acts as the second step when you sign in. The app creates a short-lived code or sends a prompt that you approve, which proves you hold the device tied to your account. Even if someone knows your password, they can’t get in without it.

Is an authentication app safer than text message codes?

Yes, in general. The FTC notes that an app’s passcode isn’t vulnerable to SIM-swap attacks or to someone hacking your email. A text code still beats having no second factor, so use it if an app isn’t offered.

Do authentication apps work without internet?

Time-based code apps do. The code comes from a stored secret and your phone’s clock, so it works in airplane mode. Push-approval prompts need a connection, and cloud backups need one to sync.

What happens if I lose my phone?

Use your recovery codes or your app’s backup to regain access. If you have neither, each site will walk you through an identity check, which can take days. Set up a backup and store recovery codes away from the phone before this happens.

Can I use one authentication app for all my accounts?

Usually yes. Apps that follow the TOTP standard work with any service that supports it, so one app can hold codes for email, banking and work accounts. Keep a backup, since all your codes then depend on one app.

Sources

• Use Two-Factor Authentication To Protect Your Accounts, Federal Trade Commission
• Multifactor Authentication Cheat Sheet, OWASP
• Authentication application, Login.gov
• Back to Basics: What’s multi-factor authentication, NIST
• No, You Shouldn’t Turn Off Two-Factor Authentication, Wirecutter