What is Google Authenticator and How to Use It

Google Authenticator is a free app that generates six-digit verification codes, refreshed every 30 seconds, which you enter alongside your password when logging in. This is known as two-factor authentication (2FA). Even if someone steals your password, they cannot get into your account without the code your phone is showing at that moment. On crypto exchanges it is one of the most common safeguards for logins, withdrawals and security changes.

How does Google Authenticator work?

The app uses the time-based one-time password (TOTP) standard. During setup, the service shows you a QR code containing a secret key shared only between your device and that service. The app combines the key with the current time to produce a fresh code every 30 seconds. The service runs the same calculation on its side, so the codes match.

No internet connection is needed to generate codes; your phone’s clock just has to be accurate.

How is it different from SMS codes?

SMS codes travel through your mobile carrier, which makes them vulnerable to SIM-swap attacks, where a fraudster has your number moved to a SIM card they control. Authenticator codes are generated on the device itself and are not tied to your phone number. That is why app-based 2FA is considered safer than SMS for crypto accounts. Stronger still are hardware security keys and passkeys (FIDO2), which only work on the genuine website.

How to set up Google Authenticator

1. Download the app from the App Store or Google Play, checking that the developer is Google.
2. On your crypto exchange, open the security settings and choose two-factor authentication (Google Authenticator / 2FA).
3. Scan the QR code with the “+” button in the app, or enter the setup key manually.
4. Write the backup key or recovery codes on paper and store them somewhere safe.
5. Enter the six-digit code from the app on the exchange to finish setup.

Do not keep the backup key as a screenshot on your phone or in cloud storage; if the phone is compromised, the backup goes with it. A paper backup is the fastest way back into your account if you lose your phone.

When will you be asked for a code?

Exchanges typically require a 2FA code to log in, withdraw crypto, add a new withdrawal address, change your password or email, and create API keys. Many also freeze withdrawals for a period, often 24 hours, after security settings change. Combined with a withdrawal address whitelist, this means that even if your password and codes are stolen, funds can only be sent to addresses you approved in advance.

How to move Google Authenticator to a new phone

Since 2023, Google Authenticator has offered the option to sync codes to your Google account. That makes switching phones easy, but it also means your codes are only as secure as your Google account. If you do not use sync, you have three options:

• Use the app’s “Transfer accounts” feature to generate a QR code on the old phone and scan it with the new one.
• Re-add each account on the new device using your saved backup keys.
• Turn off 2FA on each service and set it up again with the new phone.

Do not wipe the old phone until you have confirmed that every account produces working codes on the new one.

What to do if you lose your phone

If you saved the backup key or recovery codes during setup, use them to set up the new device. If not, you will need to go through the service’s account recovery process. Crypto exchanges usually ask for identity verification under their KYC procedures, often including a fresh selfie, and the process can take several days. The delay is deliberate: scammers also file fake recovery requests to hijack accounts.

Why is my Google Authenticator code not working?

• Your phone’s clock has drifted: switching date and time to automatic usually fixes it.
• You are using an old entry: turning 2FA off and on again creates a new secret key, so the old entry in the app no longer works and should be deleted.
• You picked the wrong account: if you have several accounts on the same exchange, give each entry a clear name.

Google Authenticator alternatives

Because TOTP is an open standard, Microsoft Authenticator, Authy and the code generators built into many password managers do the same job. How you back up matters more than which app you choose: cloud sync is convenient, while an offline backup keeps your security from hinging on a single cloud account.

Is Google Authenticator safe?

The app itself is a strong layer of protection; its weak points are the habits around it. Codes expire after 30 seconds, so an old stolen code is useless, but a code typed into a fake page can be used by an attacker straight away. If you turn on cloud sync, protect your Google account with a strong password and its own second factor. A screen lock on your phone also limits who can open the app. In short, Authenticator is clearly safer than SMS, but it is not as phishing-resistant as a hardware security key.

Common 2FA security mistakes

• Sharing a code: no legitimate support agent, social media account or form will ever need your 2FA code to “verify your account”.
• Typing a code into a fake login page: phishing sites can capture your password and live code together and use them instantly. Check the domain in the address bar; our guide to protecting yourself from phishing explains more.
• Disabling 2FA because someone asked: a “support agent” or “investment adviser” asking you to switch off 2FA is a classic scam. Real platforms never ask this.
• Deleting an entry before disabling 2FA: turn off 2FA on the service first, or you may lock yourself out.

Finally, 2FA protects your exchange account, not the assets in your own wallet. For self-custody, real security comes from storing your seed phrase properly.

Sources

• Google: Get verification codes with Authenticator
• IETF RFC 6238: TOTP standard