Google Authenticator vs Microsoft Authenticator Comparison

Signed in to a Google Account, the app copies your secrets to that account, where Google says it encrypts them in transit and at rest. Choosing Use without an account keeps the codes only on the phone. There is no option to encrypt the synced copy with a password or key of your own, so Google can technically decrypt it.

On Android, until you turn on Cloud Backup, the secrets stay on the phone. Microsoft's 2019 description of the backup says the app encrypts it with a key it requests from Microsoft's own key service and fetches that key again to restore, so with backup on Microsoft holds the key to the copy. On iPhone the current help pages do not say whether the app's iCloud switch starts on, or whose key protects the copy. There is no option to protect the backup with a password or key of your own.

The only backup is the copy in your Google Account. Without an account, the app makes no backup file; codes can only be moved by scanning transfer QR codes from the old phone.

Android: the backup is stored with a Microsoft personal account you choose; Microsoft says that from January 2027 the Android backup will move to Google One backup instead. iPhone and iPad: the backup goes to your iCloud account once several iCloud settings and the app's own iCloud switch are on, and Microsoft's current help pages do not say whose key protects it. A backup made on one platform cannot be restored on the other, and work or school accounts are not backed up at all.

A Google Account is needed only for syncing. The app works without one, and Google's help page describes how to use it that way from the first launch.

Codes for other services are added by scanning a QR code, without signing in to Microsoft. A Microsoft personal account is needed for push sign-in to that account and, on Android, to store the backup; on iPhone the backup uses your Apple account's iCloud.

The app is published by Google LLC, a Delaware company based in Mountain View, California. Google's terms are governed by California law unless local law requires otherwise; Google says that for most services the provider is either Google LLC, operating under US law, or Google Ireland Limited, operating under Irish law.

The app is published by Microsoft Corporation of Redmond, Washington. Microsoft's privacy statement names Microsoft Corporation as the controller of personal data, and Microsoft Ireland Operations Limited for people in the European Economic Area, the United Kingdom and Switzerland. Microsoft says it discloses personal data when required by law or to respond to valid legal process.

Google LLC is a wholly owned subsidiary of Alphabet Inc., whose shares trade on Nasdaq. Google released Authenticator in 2010 and added Google Account sync in April 2023.

Microsoft Corporation is a publicly traded company (ticker MSFT). The app is part of Microsoft's sign-in products for personal Microsoft accounts and for work or school accounts in Microsoft Entra ID.

The app has no revenue of its own; Google pays for its development as part of its account-security products.

The app has no revenue of its own; Microsoft pays for it as part of its sign-in products for personal and work accounts.