Google Authenticator is Google’s free app for two-factor authentication codes on Android, iPhone and iPad. Google released it in 2010. It is reviewed here on the same five criteria as every other app in this section, as a point of reference rather than a recommendation.

The review turns on one choice the app asks for at the start: sign in with a Google Account or use the app without one. Signed in, your secrets are copied to Google’s servers, so a lost phone does not lose the codes as long as you can still sign in to the Google Account, but Google can technically decrypt them. Without an account, the secrets stay on the phone and there is no backup at all.

Secret Custody & Recovery

Each account you add to the app holds a seed secret: whoever has it can produce your codes without your phone. Since April 2023 Google Authenticator can sync these secrets to your Google Account. Google announced the change on its security blog, explaining that until then the codes lived on a single device, so losing it meant losing access to every service set up with the app. To turn sync on, you sign in to a Google Account in the app, and the app asks you to do so when it first opens.

Google’s help page says it “encrypts Authenticator codes both in transit and at rest across our products”. That is encryption at rest with keys Google manages: it protects the copy from someone who steals a disk, not from Google itself. The app has no setting to lock the synced copy with a password or key that only you hold, so key custody for the copy stays with Google. In April 2023, days after the launch, security researchers at Mysk reported that the sync traffic was not end-to-end encrypted, meaning Google can see the secrets. Google answered that it planned to offer end-to-end encryption for Authenticator “in the future”. Google’s help page in October 2026 still describes only encryption in transit and at rest.

The synced copy is also only as safe as the Google Account behind it. In August 2023 an attacker phished an employee of the software company Retool, obtained one code by phone and reached the employee’s Google account. Retool wrote in September 2023 that this “gave the attacker access to all their MFA codes”, because they were synced to that account, and called the sync “the major reason” the attacker got into its internal systems; 27 Retool cloud customers had their accounts accessed. Anyone who takes over your Google account can reach the codes in the same way, and Google can be ordered to hand them over under a valid court order. This was not a flaw in the app or a breach of Google, but it shows what the synced copy depends on.

The other path is “Use without an account”. The codes then stay only on the phone, are removed from your Google Accounts, and do not appear on your other devices. In this mode the app makes no backup: no file, no copy in your own cloud storage. Google’s help page says that if a phone with unsynced codes is lost, you have to visit every site where you set up Google Authenticator to remove the old codes and link a new device. If you have not set up another way to sign in to those sites, that means going through each site’s own account recovery.

On the phone itself, the app can ask for your PIN, pattern, fingerprint or face before it opens. This setting, called Privacy Screen, is off until you turn it on.

Account & Metadata Privacy

A Google Account is needed only for syncing, and the app works without one (account-less use). With sync on, the codes are tied to that account and sit alongside everything else Google holds about it. Several Google Accounts can be added to the app, and each code can be moved from one account to another.

Google’s declarations in the app stores list crash logs, app interactions and device IDs collected for analytics, and Google Play does not mark them as optional. The App Store listing goes further and names coarse location, contact information, contacts and identifiers among the data that may be linked to you. Google’s privacy policy says it collects IP addresses, crash reports and system activity whenever a Google service contacts its servers. Google documents no setting in the app that turns this telemetry off; these are the developer’s own declarations. Google Play states that the app shares no data with third parties.

Transparency & Verifiability

The app and the service that stores synced codes are closed source. Google once published an open-source version of the Android app, but that repository was archived in 2020, and its own description says the version in the store “still remains proprietary”. Without the code, nobody outside Google can check how the app stores the secrets on the phone or what it sends during sync.

Google publishes no security audit of Google Authenticator. Google’s bug bounty covers its mobile apps: bugs in Google apps on the App Store qualify under the main Google and Alphabet programme, and Android apps fall under a separate Google mobile programme.

The app is published by Google LLC, a Delaware company based in Mountain View, California, and a subsidiary of Alphabet Inc. Google says that for most of its services the provider is either Google LLC, under US law, or Google Ireland Limited, under Irish law. Google reviews government requests, tries to narrow those that ask for too much, and usually notifies the user first; its transparency report is published by Google as a whole. Synced codes are stored in your Google Account, so a valid order for the account’s content can reach them.

Usability, Portability & Platforms

Google Authenticator runs on Android 6.0 or later and on iPhone and iPad with iOS 17 or later. There is no desktop or browser version. It supports time-based and counter-based codes (TOTP and HOTP), adds accounts by scanning a QR code, and works without an internet connection. With sync, the same codes appear on every phone signed in to the same Google Account.

The only export is Transfer codes: the old phone shows one or more QR codes, and Google describes them only as a way to move codes to Google Authenticator on a new phone. The app makes no backup file and shows no standard link for each account, so if Google stopped supporting the app, you would have no documented way to take the secrets elsewhere, though other authenticator apps can read these QR codes, other than setting up two-factor login again at each site. The app accepts new accounts through standard setup QR codes and keys, and codes transferred from another copy of Google Authenticator.

Funding & Sustainability

Google Authenticator is free, with no paid tier, no in-app purchases and no ads. It has been maintained since 2010, and both store listings show updates in October 2026. The app earns nothing on its own: Google pays for it as part of its account-security work, so its future depends on Google’s plans rather than on any revenue from users.

Pros and Cons

Free, with no ads and no paid tier, and maintained by Google since 2010
Optional sync to a Google Account brings codes back on a new phone after a normal sign-in
Works without a Google Account, with the codes kept only on the phone
Time-based and counter-based codes, generated without an internet connection
Google's bug bounty covers its mobile apps

Synced codes can be decrypted by Google, and there is no option to lock them with your own key
Anyone who takes over your Google Account can reach every synced code
Without an account the app makes no backup, so a lost phone means relinking every site
Codes leave the app only as transfer QR codes for Google Authenticator on another phone
Closed source, with no published security audit
Analytics on app use and device IDs, with no documented setting in the app to turn them off
No desktop app

Our Rating

Secret Custody & Recovery3.5/10
When you sign in, the app copies your secrets to your Google Account, where Google says it encrypts them in transit and at rest. There is no setting to lock that copy with a key of your own, so Google can technically decrypt it. Without an account the secrets stay only on the phone, but then the app makes no backup at all. In return, the synced copy comes back on a new phone after a normal Google sign-in, as long as you can still sign in.
Account & Metadata Privacy4.0/10
A Google Account is optional and needed only for syncing. The store declarations list crash logs, app interactions and device IDs collected for analytics, with no setting in the app documented to stop it, and with sync the codes sit next to everything else Google holds about the account.
Transparency & Verifiability3.0/10
The app and the sync service are closed source; the open-source version Google once published was archived in 2020 and differs from the store app. Google publishes no security audit of Authenticator. Google's bug bounty covers its mobile apps. Google LLC is a US company that answers government requests under US law.
Usability, Portability & Platforms5.5/10
Apps for Android, iPhone and iPad, with time-based and counter-based codes, QR setup and sync across your phones. There is no desktop app. Codes leave the app only as transfer QR codes that Google documents for Google Authenticator on another phone, not as a file or standard links.
Funding & Sustainability7.0/10
Free, with no ads and no paid tier, and maintained by Google since 2010 with regular updates. The app earns nothing on its own, so its future depends on Google's own plans for account security.

Overall4.3/10

Secret Custody & Recovery 30% · Account & Metadata Privacy 20% · Transparency & Verifiability 20% · Usability, Portability & Platforms 20% · Funding & Sustainability 10%

See our rating methodology →