How to Use an Authenticator App for Two-Factor Authentication on Your Phone

A password alone is no longer enough for the accounts that matter most. If someone guesses it, steals it in a data breach, or tricks you into typing it on a fake page, they can walk straight in. An authenticator app adds a second check that changes every 30 seconds, so a stolen password on its own is usually not enough.

The good news is that setting one up takes only a few minutes per account. This guide walks through the setup on iPhone and Android, explains how to keep backup codes safe, and covers what to do when you change phones or lose your device.

Step 1: Pick an authenticator app and install it

Start by choosing one authenticator app and sticking with it, so your codes live in one place. Popular free options include Google Authenticator, Microsoft Authenticator, and Authy, all available in the App Store on iPhone and Google Play on Android. Download the app from the official store listing.

Open the app once it is installed. Most apps will ask you to set a lock, such as a PIN, fingerprint, or face unlock, for the app itself. Turn that lock on if it is offered.

Step 2: Turn on two-factor authentication in each account

Next, open the account you want to protect, such as your email, bank, or social media account, and find its security settings. Look for terms like two-factor authentication, two-step verification, or login verification. On many services you will find it under Settings, then Security, then Sign-in or Password and security.

Choose the authenticator app option when the service offers a choice between text codes, email codes, and an authenticator app. Text codes are better than nothing, but app codes are generated on your own device and do not travel over the mobile network.

The service will then show a QR code on screen, plus a setup key made of letters and numbers. Open your authenticator app, tap the option to add an account, and choose Scan QR code. Point your phone camera at the code on screen. The app will add the account and start showing six-digit codes that change regularly.

Step 3: Confirm the code and save your backup codes

After the app adds the account, the service will ask you to type in the current six-digit code to prove the setup worked. Open your authenticator app, read the code for that account, and type it into the service before it expires. If the code changes while you are typing, wait for the next one and use that instead.

This is the step most people skip, and it is the one that saves you later. The service will usually show a set of backup codes, sometimes called recovery codes, after setup. Save these codes somewhere safe and separate from your phone, such as printed on paper in a drawer at home, or in a password manager you trust. Do not screenshot them and leave the image in your photo gallery, and do not email them to yourself.

If you lose your phone and have no backup codes, getting back into an account can take days and may need identity checks. If you have backup codes, recovery is often a matter of minutes.

Step 4: Protect email first, then banks and social accounts

You do not need to secure every account in one sitting. Start with your email, because email is often the key to resetting other accounts. If someone controls your email, they can often reset passwords elsewhere, so email deserves an authenticator code before anything else.

Next, add your bank and payment accounts, then your main social accounts. For each one, follow the same pattern: turn on two-factor authentication, choose the authenticator app, scan the QR code, confirm a code, and save the backup codes.

Step 5: Move your codes safely when you change phones

Changing phones is where most people lose access, so plan the move before you wipe the old phone. First, check whether your authenticator app offers a way to transfer accounts or back them up. Some apps let you export accounts to a new device by scanning a transfer QR code on the old phone.

If your app has no transfer option, open each service on a computer, turn off two-factor authentication, and set it up again on the new phone, one account at a time. Do this while you still have the old phone in hand, so you can confirm codes on the old device if a setup step fails.

Only wipe or trade in the old phone after you have confirmed that codes on the new phone work for your email and bank.

Step 6: What to do if you lose your phone

If your phone is lost or stolen, work through your accounts in order of importance. First, use a backup code to sign in to your email from another device, and change the email password if you think the phone was unlocked. Then sign in to your bank and payment accounts, review recent activity, and change passwords where needed.

For each other account, sign in with a backup code, then remove the lost phone from the account’s trusted devices if that option exists, and set up the authenticator app again on your replacement phone. If you have no backup codes for an account, use the service’s account recovery process, which may ask for identity details or a waiting period.

Frequently Asked Questions

Is an authenticator app safer than text message codes?

In most cases, yes. App codes are generated on your device and change every 30 seconds, while text codes travel over the mobile network and can be intercepted in some attacks. Text codes are still much better than no second factor at all.

What happens if my authenticator app codes stop working?

Check that your phone clock is set to automatic time, because codes depend on accurate time. If the clock is off by more than a minute, codes may fail. Also make sure you are reading the code for the right account. If codes still fail, use a backup code to sign in and set up the app again.

Can I use one authenticator app for all my accounts?

Yes, and that is the simplest setup for most people. One trusted authenticator app can hold codes for email, banks, social accounts, and work tools. Just make sure the app itself is locked, and keep your backup codes stored safely away from your phone.