“Turn on a second factor with an app” sounds simple until you open the app store: dozens of authenticators, all looking alike, the difference unclear. Here is what actually differs.
What to ask before installing
| Property | Why it matters |
|---|---|
| Does it sync | Decides what happens when the phone is lost: signing in to an account, or re-enrolling every service by hand |
| Can codes be exported | Without export you are tied to that app permanently |
| Can the app be locked | An unlocked phone in someone else's hands should not open your codes |
| Does it work on a computer | A second device saves you when the phone is gone |
| Is the backup encrypted | A backup of codes in the clear is the same codes in someone else's hands |
| Does it show codes on the lock screen | A notification with a code is visible to anyone |
Cloud or device-only
- Moving to a new phone is just signing in
- Losing the phone does not mean losing access
- Codes available on a tablet and a computer
- In exchange: you trust a service to hold the secrets
- Secrets never leave the phone
- Losing the phone means losing every code
- Migration is manual, service by service
- Requires discipline: the backups are on you
The right-hand column is marked red not because the option is bad but because it demands work from you. If you will genuinely keep backups, it is the safer choice. If not, sync will save you from your own forgetfulness.
Setup: what to do at the moment of enrolment
-
Save the secret key
When enrolling, the service shows a QR code and, next to it, a string of letters and digits — that is the secret. Save it in your password manager: from it, codes can be restored in any other app.
This is the only moment: the service will not show it again.
-
Download the backup codes
Separately from the secret. They are different things: the secret restores code generation, backup codes give a one-off entry.
-
Test the login immediately
Sign out and back in while everything is at hand. A mistake is easy to fix now and impossible to spot in a month.
-
Add a second device
If the app allows it — enrol a tablet or computer with the same secret.
Common questions
- Codes stopped being accepted. Check automatic time sync on the phone: a code is derived from the current time, and a drifting clock breaks the match.
- Can two apps be used at once. Yes, if you add the same secret to both. A useful fallback.
- The app is deleted, the phone is fine. Reinstall and enter the saved secrets. If you have none, re-enrol using backup codes.
- The phone is lost. The order is covered separately in changing phones.
Why a second factor matters at all, and how it differs from SMS and a hardware key, is in two-factor authentication.