How to use Google Authenticator

A free app on your phone that gives you a short-lived 6-digit code. With it, a stolen password alone is no longer enough to get into your accounts.

Why this is safer

Two-step verification adds an extra layer of security to your account in case your password is stolen. Someone who has your password still needs the code from your phone.
A code from an app on your own phone cannot be taken over by someone who moves your phone number to their SIM card (a "SIM swap"), unlike a code sent by text message.
With Google Authenticator signed in to your Google Account, your codes are kept in your account and come back on a new phone.

Before you start

A smartphone with a screen lock (PIN, fingerprint or face).
Preferably a Google Account, so your codes are synchronised. See our guide How to create a Google Account.

1. Install the app

Android: Google Authenticator on Google Play.
iPhone: Google Authenticator on the App Store.
Check that the developer is Google LLC. Some other apps have almost the same name.

2. Open the app and sign in

Open Google Authenticator and tap Get Started.
Sign in with your Google Account. Your codes are then synchronised with your account.
If you choose Use without an account, the codes stay only on this phone. If the phone is lost, so are the codes.

3. Add an account (for example a website or email service)

On the website, open the security settings and switch on two-step verification with an authenticator app. The website shows a square QR code.
In Google Authenticator, tap the add button (+) and choose Scan a QR code. Point the camera at the code on the screen.
Only one device, or the camera does not work? Choose Enter a setup key instead and type the key the website shows.
The app now shows a 6-digit code for that website. Type it on the website to confirm.
Many websites then give you backup codes. Print them, or keep them in your password manager, for when your phone is lost.

4. Logging in

After your password, the website asks for the code. Open the app and type the 6 digits shown for that website. A code is only valid for a short time; if it has just changed, use the new one.

5. Moving to a new phone

Codes synchronised with your Google Account: install the app on the new phone and sign in. Your codes appear by themselves.
Not synchronised, Android: on the old phone open the menu, tap Transfer codes › Export codes and choose the accounts. On the new phone tap Transfer codes › Import codes and scan the QR code shown on the old phone.
Not synchronised, iPhone: the same, under Transfer accounts › Export accounts and Import accounts.

6. If your phone is lost or stolen

Lock or erase the phone from another device: for Android with Find Hub, for iPhone with Find My.
Remove the lost phone from your Google Account.
Log in to your important accounts with a backup code and set up the authenticator again on your new phone.
Cannot get in? Contact the support of that service as soon as possible.

Codes not accepted? Check that the time on your phone is set automatically. A phone with the wrong time makes wrong codes.

Lost or stolen device?

If you are a client of ours and your phone or computer has crashed, or was lost or stolen, let us know as soon as possible. Write to us using the contact details on our contact page, or use the direct email address or telephone number we gave you (we do not publish these). We can lock your account with us straight away, reset your login password, and help you set everything up again.

Sources (checked 20 October 2026)

Google Authenticator help (Android and iPhone). support.google.com
Google: 2-Step Verification. support.google.com
Google: security best practices. support.google.com