{"id":248449,"date":"2026-10-29T01:00:11","date_gmt":"2026-10-29T01:00:11","guid":{"rendered":"https:\/\/logmeonce.com\/resources\/what-authentication-app\/"},"modified":"2026-10-29T01:00:13","modified_gmt":"2026-10-29T01:00:13","slug":"what-authentication-app","status":"publish","type":"post","link":"https:\/\/logmeonce.com\/resources\/what-authentication-app\/","title":{"rendered":"What Authentication App Should You Use? A Plain Guide"},"content":{"rendered":"<div class=\"336cb5b64765e27a1a6c1bb71b941f1a\" data-index=\"1\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-4830628043307652\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- above content -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-4830628043307652\"\r\n     data-ad-slot=\"5864845439\"\r\n     data-ad-format=\"auto\"\r\n     data-full-width-responsive=\"true\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<\/div>\n<\/p>\n<p>An authentication app is a small program on your phone that proves it\u2019s really you signing in. It does this by showing a short code that changes every 30 seconds or so, or by asking you to approve a sign-in with a tap. The right one for you is an app that works with the accounts you care about, lets you back up your codes, and stays out of your way. This guide explains how these apps work, how to set one up, what to do when you change phones, and how to remove one without locking yourself out.<\/p>\n<div data-blg-cta=\"after_tldr\" data-blg-cta-layout=\"banner\" style=\"margin:28px 0;font-family:-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif\">\n<div style=\"border-radius:26px;padding:min(22px,3.2vw)\">\n<div style=\"background:#ffffff;border-radius:18px;overflow:hidden\">\n<div style=\"padding:34px 30px;text-align:center\">\n<div style=\"margin:0 0 18px\"><span style=\"max-width:100%;border-radius:999px;padding:6px 13px;font-size:12px;font-weight:800;letter-spacing:0.1em;text-transform:uppercase;line-height:1.3;background:#F47F24;color:#ffffff\">Logmeonce<\/span><\/div>\n<div style=\"font-size:26px;font-weight:800;line-height:1.2;letter-spacing:-0.01em;color:#1f2937;margin:0\">Protect More Than Your Password<\/div>\n<div style=\"width:56px;height:6px;border-radius:3px;background:#F47F24;margin:12px 0 14px;margin-left:auto;margin-right:auto\"><\/div>\n<div style=\"font-size:15px;line-height:1.55;color:#64748b;margin:0 0 24px;max-width:44em;margin-left:auto;margin-right:auto\">Explore LogMeOnce resources on password management, multi-factor authentication, and identity security for personal and organizational needs.<\/div>\n<p><a href=\"https:\/\/logmeonce.com\/resources\" style=\"align-items:center;gap:9px;border-radius:10px;font-weight:700;font-size:15px;text-decoration:none;padding:13px 22px 13px 26px;background:#F47F24;color:#ffffff\">Explore security resources<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_77 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#TLDR\" >TL;DR<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#What_an_authentication_app_does\" >What an authentication app does<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#How_authentication_apps_work\" >How authentication apps work<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#Time-based_codes\" >Time-based codes<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#Push_approvals\" >Push approvals<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#Authentication_app_vs_text_message_codes_vs_passkeys\" >Authentication app vs. text message codes vs. passkeys<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#Which_accounts_to_protect_first\" >Which accounts to protect first<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#How_to_set_up_an_authentication_app\" >How to set up an authentication app<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#What_to_look_for_when_choosing_an_app\" >What to look for when choosing an app<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#Perspective_where_authentication_apps_fall_short\" >Perspective: where authentication apps fall short<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#Using_one_password_manager_for_passwords_and_second_factors\" >Using one password manager for passwords and second factors<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#Moving_to_a_new_phone_without_losing_access\" >Moving to a new phone without losing access<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#How_to_remove_an_authentication_app_from_an_account\" >How to remove an authentication app from an account<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#Common_mistakes_to_avoid\" >Common mistakes to avoid<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#FAQ\" >FAQ<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#What_is_an_authentication_app_used_for\" >What is an authentication app used for?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#Is_an_authentication_app_safer_than_text_message_codes\" >Is an authentication app safer than text message codes?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#Do_authentication_apps_work_without_internet\" >Do authentication apps work without internet?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#What_happens_if_I_lose_my_phone\" >What happens if I lose my phone?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#Can_I_use_one_authentication_app_for_all_my_accounts\" >Can I use one authentication app for all my accounts?<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-21\" href=\"https:\/\/logmeonce.com\/resources\/what-authentication-app\/#Sources\" >Sources<\/a><\/li><\/ul><\/nav><\/div>\n<h2 id=\"tldr\"><span class=\"ez-toc-section\" id=\"TLDR\"><\/span>TL;DR<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>An authentication app is a second step after your password. It generates a one-time code (or a push prompt) that only your device can produce.<\/li>\n<li>It beats text-message codes because it can\u2019t be intercepted through a SIM swap, according to the <a href=\"https:\/\/consumer.ftc.gov\/articles\/use-two-factor-authentication-protect-your-accounts\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">FTC<\/a>.<\/li>\n<li>Turn it on first for your main email, bank and health accounts, then for everything else that offers it.<\/li>\n<li>Pick an app with encrypted backup or transfer, so a lost phone doesn\u2019t mean a lost account.<\/li>\n<li>Before removing an app, switch the account to another method first. Deleting the code entry alone can lock you out.<\/li>\n<\/ul>\n<h2 id=\"what-an-authentication-app-does\"><span class=\"ez-toc-section\" id=\"What_an_authentication_app_does\"><\/span>What an authentication app does<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>An authentication app, also called an authenticator app, sits on your phone or tablet. When you log in to an account, the site asks for something beyond your password. The app supplies it. The U.S. Federal Trade Commission describes it as a way to <a href=\"https:\/\/consumer.ftc.gov\/articles\/use-two-factor-authentication-protect-your-accounts\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">verify that it\u2019s you trying to log in<\/a>, either by generating a passcode or by sending a login-approval notification.<\/p>\n<p>That is the whole idea behind two-factor authentication (2FA). Your password is something you know. The app is something you have. An attacker who steals your password from a breached site still can\u2019t sign in, because they don\u2019t have your phone.<\/p>\n<p>People search for this in a few different ways. \u201cWhat is my authentication app?\u201d usually means \u201cwhich app is already holding my codes?\u201d Check your phone\u2019s home screens and app library for a code-generating app, or look in your password manager, since many include one. \u201cWhat does it mean to authenticate an app?\u201d is a different question: it can mean approving a new device or linking a service to an account. This guide focuses on the first meaning: the app that proves you are you.<\/p>\n<h2 id=\"how-authentication-apps-work\"><span class=\"ez-toc-section\" id=\"How_authentication_apps_work\"><\/span>How authentication apps work<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>There are two common behaviors, and many apps do both.<\/p>\n<h3 id=\"time-based-codes\"><span class=\"ez-toc-section\" id=\"Time-based_codes\"><\/span>Time-based codes<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The most common type produces a time-based one-time password, or TOTP. <a href=\"https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/Multifactor_Authentication_Cheat_Sheet.html\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">OWASP\u2019s multifactor authentication guidance<\/a> explains the flow. When you set it up, the service shows a QR code. You scan it with the app. From then on, the app generates a numeric code from a shared secret and the current time, using a fixed time step. The standard behind it, RFC 6238, recommends 30 seconds as the default.<\/p>\n<p>Two things follow from this:<\/p>\n<ul>\n<li><strong>It works offline.<\/strong> The code comes from the secret and the clock, not from a network connection. Airplane mode is fine.<\/li>\n<li><strong>It works across apps.<\/strong> Because TOTP is a standard, a compliant app can work with many compatible services, as OWASP notes. You are not locked to one vendor\u2019s app for each site.<\/li>\n<\/ul>\n<p>The flip side: the secret in that QR code is the key to your second factor. Anyone who copies it can generate your codes. Treat the QR code during setup like a password, and don\u2019t screenshot it and leave it in your photos.<\/p>\n<h3 id=\"push-approvals\"><span class=\"ez-toc-section\" id=\"Push_approvals\"><\/span>Push approvals<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Some apps skip the typing. Instead, the service sends a push notification with the details of the login attempt, and you <a href=\"https:\/\/consumer.ftc.gov\/articles\/use-two-factor-authentication-protect-your-accounts\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">approve or deny it with a tap<\/a>. It\u2019s faster than copying six digits. The risk is habit: if you tap \u201capprove\u201d on a prompt you didn\u2019t start, you\u2019ve let someone in. If a prompt appears when you\u2019re not signing in, deny it and change that account\u2019s password.<\/p>\n<h2 id=\"authentication-app-vs-text-message-codes-vs-passkeys\"><span class=\"ez-toc-section\" id=\"Authentication_app_vs_text_message_codes_vs_passkeys\"><\/span>Authentication app vs. text message codes vs. passkeys<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>You\u2019ll see three options on most security settings pages. Here is how they compare.<\/p>\n<table>\n<thead>\n<tr>\n<th>Method<\/th>\n<th>How it works<\/th>\n<th>Main strength<\/th>\n<th>Main weakness<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Text message (SMS) code<\/td>\n<td>A code is texted to your number<\/td>\n<td>Easy, no app needed<\/td>\n<td>Exposed to SIM-swap attacks and phone-number takeover<\/td>\n<\/tr>\n<tr>\n<td>Authentication app<\/td>\n<td>App generates a code or receives a push<\/td>\n<td>Not tied to your phone number; TOTP works offline<\/td>\n<td>Need a backup plan for a lost phone<\/td>\n<\/tr>\n<tr>\n<td>Passkey or passwordless login<\/td>\n<td>Your device and a biometric or PIN replace the password<\/td>\n<td>Nothing to type or phish<\/td>\n<td>Not yet offered everywhere<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The FTC states that an authenticator app is <a href=\"https:\/\/consumer.ftc.gov\/articles\/use-two-factor-authentication-protect-your-accounts\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">safer than SMS or email codes<\/a> because the passcode isn\u2019t susceptible to SIM-swap attacks or someone hacking your email. That doesn\u2019t make SMS useless. A text code is far better than no second factor. But when a site offers a choice, take the app.<\/p>\n<p>Passkeys and passwordless sign-in go a step further by removing the password itself. They are growing, but you\u2019ll still need codes for the many sites that haven\u2019t adopted them. For now, an authentication app is the practical middle ground. If you want to see where passwordless is heading, our <a href=\"https:\/\/logmeonce.com\/passwordless-qr-code-login\/\" target=\"_blank\" rel=\"noopener\">passwordless QR code login<\/a> page shows one approach.<\/p>\n<h2 id=\"which-accounts-to-protect-first\"><span class=\"ez-toc-section\" id=\"Which_accounts_to_protect_first\"><\/span>Which accounts to protect first<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>No need to do everything in one afternoon. NIST advises turning on multifactor authentication <a href=\"https:\/\/www.nist.gov\/blogs\/cybersecurity-insights\/back-basics-whats-multi-factor-authentication-and-why-should-i-care\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">whenever possible, especially for sensitive accounts<\/a> such as your primary email, financial accounts and health records.<\/p>\n<p>A sensible order:<\/p>\n<ol>\n<li><strong>Primary email.<\/strong> It\u2019s the reset path for almost every other account. Whoever controls it controls the rest.<\/li>\n<li><strong>Banking, brokerage and payment apps.<\/strong><\/li>\n<li><strong>Health portals and insurance.<\/strong><\/li>\n<li><strong>Your password manager and cloud storage.<\/strong><\/li>\n<li><strong>Social media and shopping accounts.<\/strong><\/li>\n<\/ol>\n<p>If you run a business, the bar is higher. OWASP recommends <a href=\"https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/Multifactor_Authentication_Cheat_Sheet.html\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">requiring some form of MFA for all users<\/a>, and requiring it for administrators and other high-privilege accounts. Start with admin consoles, email, payroll and anything that touches customer data.<\/p>\n<h2 id=\"how-to-set-up-an-authentication-app\"><span class=\"ez-toc-section\" id=\"How_to_set_up_an_authentication_app\"><\/span>How to set up an authentication app<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The steps are nearly the same everywhere. Login.gov, the U.S. government\u2019s sign-in service, shows the pattern: you sign in, select \u201cEnable\u201d next to \u201cAuthentication app,\u201d then <a href=\"https:\/\/www.login.gov\/help\/create-account\/authentication-methods\/authentication-application\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">scan the code or enter it to associate the app with your account<\/a>. After that, you use the app\u2019s one-time passcodes to sign in.<\/p>\n<p>A general walkthrough:<\/p>\n<ol>\n<li><strong>Install an authentication app<\/strong> from your phone\u2019s official app store.<\/li>\n<li><strong>Open the account\u2019s security settings<\/strong> on a computer or second screen. Look for \u201ctwo-step verification,\u201d \u201ctwo-factor authentication\u201d or \u201cauthenticator app.\u201d<\/li>\n<li><strong>Choose the authenticator option.<\/strong> The site shows a QR code and often a text setup key.<\/li>\n<li><strong>Scan the QR code<\/strong> in the app. If you can\u2019t scan, type the setup key by hand.<\/li>\n<li><strong>Enter the six-digit code<\/strong> the app shows to confirm the pairing.<\/li>\n<li><strong>Save the recovery codes<\/strong> the site gives you. Store them somewhere other than your phone, such as in an encrypted vault or a printed copy in a safe place.<\/li>\n<\/ol>\n<p>That last step is the one people skip, and it\u2019s the one that saves you later.<\/p>\n<p>If you use LogMeOnce, our support team keeps a <a href=\"https:\/\/support.logmeonce.com\/hc\/en-us\/articles\/115011470807-How-to-Setup-and-Use-Google-Authenticator-Authy-FreeOTP-TOTP-with-2FA-V7-0\" target=\"_blank\" rel=\"noopener\">step-by-step setup guide for TOTP apps<\/a> that covers using a standard code-generating app with your LogMeOnce account.<\/p>\n<h2 id=\"what-to-look-for-when-choosing-an-app\"><span class=\"ez-toc-section\" id=\"What_to_look_for_when_choosing_an_app\"><\/span>What to look for when choosing an app<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>There is no single best app for everyone. Compare on these points instead.<\/p>\n<p><strong>Backup and transfer.<\/strong> This matters most. Many apps let you store <a href=\"https:\/\/www.nytimes.com\/wirecutter\/guides\/online-security-set-up-two-factor-authentication\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">optional backups of your codes online<\/a>, so you can get them back on a new phone. Without a backup, a lost phone means going through each site\u2019s recovery process one by one. Check that the backup is encrypted and protected by a strong passphrase.<\/p>\n<p><strong>Standard TOTP support.<\/strong> If an app follows the TOTP standard, you can move your codes later. A proprietary-only app can trap you.<\/p>\n<p><strong>Lock screen or biometric lock.<\/strong> Anyone who picks up your unlocked phone shouldn\u2019t be able to open your codes. Look for a PIN, fingerprint or face unlock on the app itself.<\/p>\n<p><strong>Multi-device support.<\/strong> If you use a phone and a tablet, or want a spare device as a fallback, check that the app can sync or export safely.<\/p>\n<p><strong>Privacy.<\/strong> Read what data the app collects. A code generator has little reason to need your contacts or location.<\/p>\n<p><strong>Where it lives.<\/strong> You have three broad types to choose from:<\/p>\n<ul>\n<li>A standalone authenticator from a device or platform maker.<\/li>\n<li>An open-source authenticator with no account or cloud.<\/li>\n<li>An authenticator built into a password manager, so codes and logins sit in one encrypted vault.<\/li>\n<\/ul>\n<p>The third type is the most convenient, but it puts more eggs in one basket. If you go that route, protect the vault with a long master password and its own second factor.<\/p>\n<h2 id=\"perspective-where-authentication-apps-fall-short\"><span class=\"ez-toc-section\" id=\"Perspective_where_authentication_apps_fall_short\"><\/span>Perspective: where authentication apps fall short<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>We build identity security software, and we\u2019ll be straight about this: an authentication app is a big improvement over a password alone, but it is not the finish line.<\/p>\n<p>The weak spots are human ones. People approve prompts they didn\u2019t start. They lose the phone with no backup. They scan a QR code during setup and leave a screenshot in their camera roll. And a convincing fake login page can still trick you into typing a valid code, which the attacker then uses within the 30-second window.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/media.babylovegrowth.ai\/blog-images\/organization-6456\/1793158324603_Perspective-where-authentication-apps-fall-short-overview-diagram.jpeg\" alt=\"Perspective: where authentication apps fall short \u2014 overview diagram\" title=\"\"><\/p>\n<p>That\u2019s why we put weight on passwordless sign-in. When there is no password to steal and the login is tied to your device and your biometrics, whole families of attacks stop working. Our passwordless login, which uses a QR code scanned from your phone, is built around that idea. We also support standard TOTP, so you can use a code-generating app with your account if that suits you better.<\/p>\n<p>Our advice for most readers: use an authentication app today on every account that offers one, keep recovery codes offline, and move to passwordless options where they exist. Don\u2019t wait for a perfect setup. A decent one that you actually turn on beats an ideal one you never get to.<\/p>\n<blockquote>\n<p><em>\u2014 Mike<\/em><\/p>\n<\/blockquote>\n<h2 id=\"using-one-password-manager-for-passwords-and-second-factors\"><span class=\"ez-toc-section\" id=\"Using_one_password_manager_for_passwords_and_second_factors\"><\/span>Using one password manager for passwords and second factors<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>If you\u2019re setting up an authentication app for the first time, it helps to decide where your passwords live too. Running a password manager and an authenticator side by side means fewer logins to remember and fewer chances to reuse a weak password.<\/p>\n<p>LogMeOnce offers a password manager with a free Premium plan at $0.00 per month, plus paid personal tiers: Professional at $2.50 per month, Ultimate at $3.25 per month and Family at $4.99 per month. For small teams, Teams is $4.00 per month per user and Business is $7.99 per month per user. Enterprise plans have no published price. You can compare the tiers on our <a href=\"https:\/\/logmeonce.com\/password-manager\/\" target=\"_blank\" rel=\"noopener\">password manager plans page<\/a> and see everything we offer on the <a href=\"https:\/\/logmeonce.com\/resources\/\" target=\"_blank\" rel=\"noopener\">LogMeOnce resources hub<\/a>.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/csuxjmfbwmkxiegfpljm.supabase.co\/storage\/v1\/object\/public\/blog-images\/organization-6456\/1760417791460_logmeonce.jpg\" alt=\"Logmeonce\" title=\"\"><\/p>\n<p>If you\u2019d also like to know whether your email addresses have turned up in known leaks, our <a href=\"https:\/\/logmeonce.com\/identity-theft-protection\" target=\"_blank\" rel=\"noopener\">identity theft protection<\/a> page explains dark web monitoring. Business buyers can see per-user options on the <a href=\"https:\/\/logmeonce.com\/business-pricing-and-comparison\/\" target=\"_blank\" rel=\"noopener\">business pricing and comparison page<\/a>.<\/p>\n<h2 id=\"moving-to-a-new-phone-without-losing-access\"><span class=\"ez-toc-section\" id=\"Moving_to_a_new_phone_without_losing_access\"><\/span>Moving to a new phone without losing access<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>This is where most authenticator trouble begins. Do the work before you trade in or reset the old device.<\/p>\n<ol>\n<li><strong>Don\u2019t wipe the old phone yet.<\/strong> Keep it until every account works on the new one.<\/li>\n<li><strong>Use your app\u2019s transfer or backup feature<\/strong>, if it has one. Restore on the new phone and test each code.<\/li>\n<li><strong>If there is no transfer feature<\/strong>, go account by account: on the old phone, open the account\u2019s security settings, add the new phone as a fresh authenticator, confirm, then remove the old entry.<\/li>\n<li><strong>Keep recovery codes handy.<\/strong> If something fails, those codes get you in.<\/li>\n<li><strong>Test your most important accounts first<\/strong>: email, bank, password manager.<\/li>\n<\/ol>\n<p>If your phone is already lost, use each site\u2019s recovery path. Have your recovery codes ready. If you didn\u2019t save any, expect identity checks, and start with your email account since it unlocks the rest. Then set up a backup before you do anything else.<\/p>\n<h2 id=\"how-to-remove-an-authentication-app-from-an-account\"><span class=\"ez-toc-section\" id=\"How_to_remove_an_authentication_app_from_an_account\"><\/span>How to remove an authentication app from an account<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>People ask this after they change phones, switch apps, or want a different method. The safe order matters.<\/p>\n<ol>\n<li><strong>Sign in to the account<\/strong> on a trusted device, using your current second factor.<\/li>\n<li><strong>Open security settings<\/strong> and find two-step verification or authenticator app.<\/li>\n<li><strong>Switch to a replacement first<\/strong>: add a new authenticator, a passkey, or a security key. If you really want to turn the feature off, the site\u2019s own settings will say how, and many services warn that this makes the account weaker.<\/li>\n<li><strong>Remove or disable the old authenticator<\/strong> on the site\u2019s side.<\/li>\n<li><strong>Only then delete the entry<\/strong> inside the app (often a swipe or long press on the code).<\/li>\n<\/ol>\n<p>The common mistake is deleting the code inside the app first. The site still expects a code, and now you have none. If that happens, you\u2019ll need a recovery code or the site\u2019s account recovery process.<\/p>\n<p>And think twice before turning 2FA off entirely. The Wirecutter security guide argues that <a href=\"https:\/\/www.nytimes.com\/wirecutter\/guides\/online-security-set-up-two-factor-authentication\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">you shouldn\u2019t turn off two-factor authentication<\/a> and suggests keeping a backup of your codes instead. If the problem is a hassle, change the method, don\u2019t remove the protection.<\/p>\n<h2 id=\"common-mistakes-to-avoid\"><span class=\"ez-toc-section\" id=\"Common_mistakes_to_avoid\"><\/span>Common mistakes to avoid<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><strong>Approving prompts you didn\u2019t trigger.<\/strong> A surprise prompt means someone has your password. Deny it and change the password.<\/li>\n<li><strong>Keeping recovery codes only on the phone.<\/strong> If the phone is gone, so are the codes.<\/li>\n<li><strong>Screenshotting setup QR codes.<\/strong> That image is your secret. Delete it or store it in an encrypted vault.<\/li>\n<li><strong>Using the app for some accounts but SMS for your email.<\/strong> Your email is the master key. Give it the strongest option.<\/li>\n<li><strong>Typing a code into a page you reached from a link.<\/strong> Go to the site yourself, then sign in.<\/li>\n<li><strong>Relying on one device.<\/strong> Have a backup plan before something breaks.<\/li>\n<\/ul>\n<h2 id=\"faq\"><span class=\"ez-toc-section\" id=\"FAQ\"><\/span>FAQ<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3 id=\"what-is-an-authentication-app-used-for\"><span class=\"ez-toc-section\" id=\"What_is_an_authentication_app_used_for\"><\/span>What is an authentication app used for?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>It acts as the second step when you sign in. The app creates a short-lived code or sends a prompt that you approve, which proves you hold the device tied to your account. Even if someone knows your password, they can\u2019t get in without it.<\/p>\n<h3 id=\"is-an-authentication-app-safer-than-text-message-codes\"><span class=\"ez-toc-section\" id=\"Is_an_authentication_app_safer_than_text_message_codes\"><\/span>Is an authentication app safer than text message codes?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Yes, in general. The FTC notes that an app\u2019s passcode isn\u2019t vulnerable to SIM-swap attacks or to someone hacking your email. A text code still beats having no second factor, so use it if an app isn\u2019t offered.<\/p>\n<h3 id=\"do-authentication-apps-work-without-internet\"><span class=\"ez-toc-section\" id=\"Do_authentication_apps_work_without_internet\"><\/span>Do authentication apps work without internet?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Time-based code apps do. The code comes from a stored secret and your phone\u2019s clock, so it works in airplane mode. Push-approval prompts need a connection, and cloud backups need one to sync.<\/p>\n<h3 id=\"what-happens-if-i-lose-my-phone\"><span class=\"ez-toc-section\" id=\"What_happens_if_I_lose_my_phone\"><\/span>What happens if I lose my phone?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Use your recovery codes or your app\u2019s backup to regain access. If you have neither, each site will walk you through an identity check, which can take days. Set up a backup and store recovery codes away from the phone before this happens.<\/p>\n<h3 id=\"can-i-use-one-authentication-app-for-all-my-accounts\"><span class=\"ez-toc-section\" id=\"Can_I_use_one_authentication_app_for_all_my_accounts\"><\/span>Can I use one authentication app for all my accounts?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Usually yes. Apps that follow the TOTP standard work with any service that supports it, so one app can hold codes for email, banking and work accounts. Keep a backup, since all your codes then depend on one app.<\/p>\n<h2 id=\"sources\"><span class=\"ez-toc-section\" id=\"Sources\"><\/span>Sources<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><a href=\"https:\/\/consumer.ftc.gov\/articles\/use-two-factor-authentication-protect-your-accounts\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Use Two-Factor Authentication To Protect Your Accounts, Federal Trade Commission<\/a><\/li>\n<li><a href=\"https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/Multifactor_Authentication_Cheat_Sheet.html\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Multifactor Authentication Cheat Sheet, OWASP<\/a><\/li>\n<li><a href=\"https:\/\/www.login.gov\/help\/create-account\/authentication-methods\/authentication-application\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Authentication application, Login.gov<\/a><\/li>\n<li><a href=\"https:\/\/www.nist.gov\/blogs\/cybersecurity-insights\/back-basics-whats-multi-factor-authentication-and-why-should-i-care\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Back to Basics: What\u2019s multi-factor authentication, NIST<\/a><\/li>\n<li><a href=\"https:\/\/www.nytimes.com\/wirecutter\/guides\/online-security-set-up-two-factor-authentication\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">No, You Shouldn\u2019t Turn Off Two-Factor Authentication, Wirecutter<\/a><\/li>\n<\/ul>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>What an authentication app is, how it makes codes, how to set one up, move it to a new phone or remove it, and what to check before you pick one.<\/p>\n","protected":false},"author":0,"featured_media":248451,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-248449","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-logmeonce"],"acf":[],"_links":{"self":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248449","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/comments?post=248449"}],"version-history":[{"count":1,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248449\/revisions"}],"predecessor-version":[{"id":248450,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248449\/revisions\/248450"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/media\/248451"}],"wp:attachment":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/media?parent=248449"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/categories?post=248449"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/tags?post=248449"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}