How to Use an Authenticator App With Any Website or Service (2024)

Authenticator apps are very common. They allow you to safely access many web browsers and gadgets. This guide shows how to use an authenticator app to visit any website or use any service.

What Are Authenticator Apps?

Authenticator apps are a way to safely sign in to different websites and user accounts. They work by verifying a randomly generated and frequently changing security code on two separate devices. It can be your phone and another device such as a laptop browser. This adds an extra layer of protection, as the code has to remain the same on both devices for a successful login.

Microsoft Authenticator and Google Authenticator are the best-known examples of authenticator apps. The latter is one of the most secure ways to sign in to your Google account on iOS and Android without requiring text messages, even when your phone is offline. You need to confirm a six-digit code which changes every 30 seconds on the mobile app, after which a new code is generated.

Authenticator apps give you extra security by requiring two different devices to confirm it’s really you. They also offer robust protection against screenshots, which ensures the codes remain local to your device.

Because the codes on an authenticator app cannot be duplicated in real time, and their random generation is hidden behind a deep layer of encryption, this method is safer than sending a one-time password to your phone. Signing in using authenticator apps is an example of two-factor authentication (TFA), and even multi-factor authentication (MFA).

FYI: learn how to use Google Authenticator on a Windows PC.

How Do Authenticator Apps Work?

While different authenticator apps have their own working mechanisms, all of them have a few things in common. After an initial setup, none of them require a password anymore. Yet, they work as a password manager for multiple user accounts. Most authenticator apps work in two different ways:

• Time-Based One-Time Password (TOTP): you only need numbered codes, which typically expire after 30 seconds. This protects you from SIM card tricks, Bluetooth hacking, and other ways hackers could steal your credentials.
• Hash-Based Message Authentication Code One-Time Password (HOTP): this is another method that uses event-based authentication. The code generated is valid until a new one is requested.

In a Google account on a desktop browser, the authenticator was previously downloaded and installed from Google Play on the code-generating mobile device. Now the user only needs to turn on two-step verification using the TOTP mechanism.

To sign in, they will need to enter a six-digit code visible on the app. After both numbered codes match, the user can access their Google account. If there’s a typo, the user needs to wait another 30 seconds to enter the correct numbered code.

Also, as authenticator apps serve as a connecting medium between two physical devices, you need two devices. At least one should be a mobile device, where the authenticator app has to be downloaded and installed.

FYI: apart from the Google Authenticator app, you can also create passkeys with Google for a genuine password-free experience

How to Set Up an Authenticator App

To set up an authenticator app, locate it on the App Store or Google Play, and download it to your phone. To initially install it, you need a user account. It means you have to either register for one or sign in using your Google, Apple ID, or Facebook account. This allows you to use your authenticator app to sign in to any account.

There are different types of websites that sync with your authenticator app. Most authenticator apps have a prominent plus sign on the homescreen to add as many user accounts as possible.

Some websites, such as Google and Microsoft apps, require you to scan a QR code. Use your phone’s camera to scan the QR code, and it will automatically add the authenticator on a secondary device. Then, use it for TOTP login.

Another way to connect an authenticator app to a website is to use a setup key. This is a private key that uses a combination of letters and numbers to be confirmed on both devices. This is useful for people who often forget to carry their phone with them.

Notably, the private key is your only way to access a site safely, and you shouldn’t lose access to it. However, WordPress websites do allow you to reset your private key.

FYI: what is PGP encryption? Find out how it secures your data.

How to Use an Authenticator App After Setup

Once your authenticator app has been set up properly, you can start using it immediately to sign in to your account on any website. First, sign in using your username and password, the first layer of successful verification.

The second layer of authentication is required next. Whether you want to access your account or a website, your authenticator app will continuously flash numbered codes. Make sure both codes match, and as soon as you enter the correct code on a secondary device, it will log you in.

One of the major drawbacks of using authenticator apps is that they require you to constantly have access to your phone. If you lose or damage your phone, you may find yourself locked out of your user account. If it’s a Google account, there are many ways to regain access, and a Google One subscription is recommended for emergencies.

Image credit: Unsplash. All screenshots by Sayak Boral.