A Google Authenticator code is a short number your phone calculates itself from a shared secret and the current time; it changes every 30 seconds and needs no signal. An SMS code is sent to your number by the service. For two-step sign-in, the app is the sturdier choice. For signing up to a new app, a text is often the only option.
How an authenticator app makes codes
- You scan a QR code once When you switch on app-based two-step sign-in, the service shows a QR code. It contains a secret that only the service and your app now share.
- The app does the maths Every 30 seconds it combines that secret with the current time and shows a new code. The method is the open TOTP standard, published in 2011 as RFC 6238.
- The service checks the same maths It knows the secret and the time too, so it can tell whether your code is right. Nothing is sent to your phone.
That is why Google Authenticator works without an internet connection or mobile service, and why a search for a Google Authenticator text message finds nothing: there is none. Your phone only needs the correct time.
SMS codes compared
| Authenticator app | SMS code | |
|---|---|---|
| Needs signal or roaming | No | Yes |
| Tied to your phone number | No | Yes |
| Can be delayed or filtered | No, it is made on the device | Yes, by carriers and spam filters |
| Lifetime of a code | About 30 seconds | Usually a few minutes |
| When you get a new phone | Move or sync the codes first | Works as soon as the SIM is in |
| Used for new sign-ups | Rarely | Almost always |
Moving to an authenticator safely
- Keep SMS on for now. Add the app as an extra method before you remove anything.
- Scan the QR code in the service's security settings and type the first code to confirm.
- Save backup codes in the same session and print them. See backup codes.
- Plan for a new phone. In Google Authenticator, codes can sync to your Google Account; without that, export them by QR code from the old phone before you reset it.
- Then decide about SMS. Remove the text method only where you have a second way in.
Services that offer both include Amazon, where 2-Step Verification codes come by text or from an authenticator app, and Steam, whose app makes its own code every 30 seconds.
When SMS is still the only option
Authenticator apps protect accounts you already have. They do not help when a new app wants to confirm a phone number at sign-up. Messengers such as WhatsApp, Telegram and Signal register you with a code by SMS or call, and so do most ride, delivery and dating apps.
Common questions
What is a Google Authenticator code?
A short, single-use number that the Google Authenticator app generates every 30 seconds for each account you added. You type it after your password.
Does Google Authenticator send text messages?
No. It calculates codes on your phone, with no SMS and no connection needed.
Is an authenticator app safer than SMS?
It does not depend on your phone number or the mobile network, so delays, filters and number changes do not affect it. Back it up, because losing the phone without a backup locks you out.
What if I get a new phone?
Sign in to the app with your Google Account so the codes sync, or export them by QR code from the old phone first. Keep backup codes as a last resort.