Quick answer: An authenticator app creates a short code on your phone that changes every 30 seconds, and you type it in after your password. To set one up, open your account’s security settings, turn on two-step verification, scan the QR code with the app and enter the first code. Save backup codes before you finish.
Passwords get stolen, reused and guessed. A second step means a thief with your password still cannot get in. The UK’s National Cyber Security Centre says the second step should be something only you can access, such as a code from an app.
Texts work, but an app is usually the better everyday choice. This guide shows how to set one up, how to avoid locking yourself out and which accounts to protect first. It is general information, not a guarantee against every attack.
What is an authenticator app?
It is a free app that generates one-time codes on your phone or tablet. Per the NCSC, apps such as Google Authenticator or Microsoft Authenticator work without a mobile signal, do not need you to wait for a text, and one app can handle many accounts. The US agency CISA describes the codes as changing every 30 seconds. See the NCSC guidance and CISA’s page.
Is an authenticator app better than SMS?
The NCSC says text-message codes are not the most secure method, but they are far better than having no second step at all. If an account only offers texts, use them. If it offers an app, the app is the usual upgrade. Some services also support security keys or passkeys, which our guide to https://insightorys.com/2026/10/05/how-to-set-up-passkeys/ covers.
How do I set up two-factor authentication with an app?
- Install an app. Google Authenticator and Microsoft Authenticator are the examples the NCSC names. Install it from your phone’s official app store.
- Open the account’s security settings. CISA says the menu may be called Account Settings or Settings and Privacy. The option may be labeled two-factor, two-step or multifactor authentication.
- Choose “authenticator app” as the method. The service will show a QR code.
- Scan the code. In the app, choose to add an account and scan the barcode on your screen.
- Enter the six-digit code. Type the code the app shows into the website to confirm setup.
- Save your backup codes. See the next section.
The steps for Google accounts follow this pattern, as Expert Reviews describes: scan the code with the app, then enter the generated code in your browser.
How do I avoid getting locked out?
The biggest risk is losing your phone. The NCSC advises setting up a backup option in case your usual second step is unavailable, and many services let you add more than one.
- Backup codes: single-use codes that work without your phone. Store them somewhere safe, such as a printed copy at home or in a password manager. Each works once, so generate new ones after using them all.
- A second method: add a backup phone number or another approved option if the service offers it.
- Check before changing phones: some apps can transfer accounts, others cannot. Confirm your accounts work on the new phone before you wipe the old one.
A password manager can hold your passwords and backup codes together. Our roundup of https://insightorys.com/2026/10/04/best-free-password-managers/ is a good place to start.
What are common mistakes to avoid?
- Skipping backup codes. It is the most common reason people get locked out after losing a phone.
- Keeping codes in a screenshot on the same phone. If the phone is gone, so are the codes.
- Sharing a code. A legitimate service will not ask you to read out a one-time code. Treat any such request as a scam; our guide on https://insightorys.com/2026/10/07/where-to-report-a-scam/ explains where to report it.
- Using security questions as a second step. The NCSC says memorable information does not offer the same protection as a real second step.
Which accounts should I protect first?
The NCSC puts email first, because access to your email can be used to reset passwords on other accounts. After that, CISA suggests turning on multifactor authentication for banking, healthcare, social media and online shopping accounts.
- Primary email accounts
- Banking and payment apps
- Cloud storage and Apple, Google or Microsoft accounts
- Social media, which are often targets; see how to https://insightorys.com/2026/10/05/recover-hacked-instagram-account/
Once set up, the NCSC notes you are usually only asked for the second step for sensitive actions, such as a login from a new device or a password change. Many services offer a “remember this browser” option. For more guides, see more app and software news and our walkthrough on https://insightorys.com/2026/10/07/how-to-cancel-subscriptions-iphone-android/.
Frequently asked questions
Are authenticator apps free?
The apps named by the NCSC, Google Authenticator and Microsoft Authenticator, are widely available for phones. Check the app store listing for current terms.
What if I lose my phone?
Use your saved backup codes or a backup method you added earlier. Without them you may need to go through the service’s account recovery process, which can take time.
Does the app need internet?
No. According to the NCSC, authenticator apps do not need a mobile signal to produce codes, though you still need a connection to log in to the website.
Can I use one app for all my accounts?
Yes. The NCSC says one authenticator app can serve many accounts.