Google Authenticator

Review by eFreeware

Google Authenticator is a free security tool from Google LLC that supplies the second code you type after your password when signing in to protected accounts. It has been on Android since March 2012 and sits in the Tools category, with more than 100 million installs and a 3.9 average from a large body of ratings. The pitch is narrow and clear: it generates verification codes, and it does so on the phone itself.

The reason to consider it is the offline part. Because the code is produced on your device rather than sent to you, it still appears when there is no network or mobile connection, which is the moment a text message or email code tends to fail. For anyone who has been locked out of an account while traveling or in a poor-signal area, that difference is the whole argument for using an authenticator instead of a message-based second step.

How the second step works in practice

The app adds a layer on top of your password: after entering it, you supply a code generated by the app on your phone. Accounts are added by scanning a QR code, which the developer describes as quick and helps ensure the codes are set up correctly rather than mistyped. From then on, the app holds the shared secret for each account and produces the current code when you need it.

The camera permission exists for that scanning step. Once an account is registered, signing in becomes a two-part routine: password first, then a glance at the app and a short string of digits. It is a small extra step that repeats every time you log in, and that repetition is the price of the protection.

Several accounts, one screen

Multiple accounts can live side by side in the app, so you are not switching between different tools each time you sign in somewhere. Each entry shows its own current code, and the app supports both time-based and counter-based code generation, letting you pick whichever type fits the account you are protecting.

That combination matters for anyone with a scattered set of logins: a work account, a personal email, a password manager, a hosting panel. Keeping them in one place means one app to open rather than several, and one list to check when something asks for a code.

Sync, transfer and the privacy screen

If your phone goes missing, you can still get at your codes, since the app lets you link them to your Google Account and share them between devices. That is the feature that changes the risk profile of the whole setup: a lost handset no longer means losing access to every account tied to it, provided the codes were synced beforehand.

Moving to a new device can also be done by transferring accounts with a QR code, which is a tidier route than re-registering each account from scratch. A more recent addition is a Privacy Screen, which puts access to the app behind your screen lock, PIN or biometric check. The same update brought a reworked interface and visuals, and the app is free with no ads and no in-app purchases.

What it asks of you

To use it with Google, you have to turn on two-step verification for that Google Account first, and the same pattern applies elsewhere: the service you are protecting has to offer this kind of second step before the app has anything to generate. The codes are only useful where the site or service supports them.

There is also a routine to accept. Every sign-in on a protected account costs you an extra step, and the app is built around that repeated action rather than around convenience. Syncing to a Google Account is the sensible counterpart to that risk, since it is what keeps you from being stranded if the phone goes missing.

The app has been around for well over a decade, and its 3.9 average across hundreds of thousands of ratings suggests a widely used tool rather than a universally loved one. What it offers is a specific job done without charge or advertising; what it demands is that you build the second step into how you sign in.

Who it fits

This suits anyone who wants a second step on their logins and would rather not depend on a message arriving. It is a natural fit for people who manage several accounts, who travel or work where a signal is unreliable, or who have already enabled two-step verification on a Google Account and need an app to produce the codes.

It also makes sense for someone replacing a phone, since syncing and QR transfer are both aimed at moving accounts without starting over. If you are setting up protection for the first time, the QR scanning route keeps the setup short and reduces the chance of a mis-typed secret.

A dependable second step for everyday logins

Google Authenticator is worth installing if you want verification codes that appear on the phone itself, work without a connection and can be carried to a new device. It is free, carries no ads or purchases, and manages several accounts in one place, with both time-based and counter-based codes available.

The conditions are part of the deal: the services you protect have to support this kind of second step, and using it with Google means enabling two-step verification on that account first. If you accept the extra step at each sign-in, this is a straightforward way to add real protection to the accounts that matter most.

What's new

* Cloud syncing: Your Authenticator codes can now be synced to your Google Account and across your devices, so that you can always access them even if you lose your phone. * Privacy Screen: Access to Authenticator can now be protected by your screen lock, PIN or biometric. * Improved UX and visuals: We've made the app easier to use and more visually appealing.