What is an authenticator app?
An authenticator app generates a six-digit code that changes every thirty seconds, computed from a secret shared with the site at setup and the current time. Because the code is derived locally and never sent over the network in advance, it cannot be intercepted the way an SMS code can.
- Topic
- Authentication
- Also called
- TOTP app, 2FA app
- Reading time
- 1 min
- Reviewed
On this page
How TOTP works
When you scan the QR code, the site gives your app a shared secret. Both sides then compute HMAC over that secret and the current 30-second time window, truncating the result to six digits. No network traffic is involved at code-generation time, which is why the app works in aeroplane mode.
Why it beats SMS
SMS codes travel over a network that can be redirected. In a SIM swap, an attacker convinces a carrier to move your number to a new SIM and receives the codes meant for you. Authenticator apps avoid that route because the shared secret stays on your device.
The backup problem
Losing the phone means losing every code unless you saved the recovery codes at setup. Save them somewhere separate from the phone, and treat that step as part of enabling 2FA rather than an optional extra.
Sources
These primary references support the terminology and current security guidance used in this definition.
