RSA Authenticator (SecurID)

Review by eFreeware

Signing in to work systems used to mean one password reused everywhere, and everyone knew how badly that aged. The fix most organizations landed on is a second factor: something you have in your hand that proves the password alone was not enough. RSA Authenticator (SecurID) is one of the long-running tools for that job, published by RSA Security and free to install.

It has been on Google Play since May 2011 and sits above 10 million installs, which tells you how deeply this style of app is embedded in corporate life. Its average rating is 3.3 from more than 18,000 ratings, a number I read as the ordinary friction of a tool people are told to install rather than one they choose. The developer's own framing is narrow: it is built for enterprises and regulated industries, and your employer has to be an RSA customer for the app to be of any use to you.

That last point shapes everything below. This is not an app you adopt for personal accounts on a whim; it is the piece of software your IT department hands you when your company already runs RSA's authentication stack.

What the app actually does

At its core, RSA Authenticator is a second factor for logging in. When you reach a protected service, the app proves the sign-in request is really coming from you. It supports one-time passcodes, QR codes, code matching, push notifications, biometrics and hardware authenticators.

The push notification route is the one most people will recognize. A sign-in attempt on another device triggers a prompt on your phone, and approving it completes the login. Code matching adds a check, so you confirm the number on the sign-in screen matches the one in the app.

Biometrics matter here because they replace a PIN or password on the phone itself with a fingerprint or face check. The app is filed under Communication on the store, which is a loose fit for something that is really an access tool, but it does not change how it behaves.

What I like about the breadth of options is that different work situations need different ones. A desk worker with a phone in hand can approve prompts all day. Someone on a factory floor, in a lab, or moving between sites may need a code they can read off a screen instead. The app covers both, provided the employer has set it up that way.

Passkeys and the passwordless pitch

Passkeys are the most notable feature. RSA issues device-bound passkeys, which the developer describes as phishing-resistant, and the pitch is that you stop typing passwords altogether for the services that support them. The passkey lives on your device and is used to authenticate you, so there is no shared secret to type into a lookalike page.

That matters more than it sounds. Most phishing succeeds because someone types a password into the wrong site. A credential that never leaves the device removes that particular failure. The developer also ties this to workforce productivity, arguing that fewer password prompts and resets mean less time lost, and to reduced risk for the organization.

I would treat the productivity line as marketing rather than a measurable promise, because how much time anyone saves depends on how many systems their employer has moved over. The security argument is the stronger one, and it is the reason passkeys have spread so quickly in corporate sign-in. For an employee, the practical benefit is simply a faster login with less to remember.

It is worth being clear about the direction of travel here: the app supports both the older code-based methods and the newer passkey approach, so an organization can move at its own pace without asking staff to install something different halfway through.

How it fits into a working day

The realistic pattern is that you install the app once, register your device with the information your help desk gives you, and then mostly forget about it until a login needs confirming. Registration is the step that decides whether the app works at all, and it is handled by your administrator rather than by anything you can arrange on your own.

Once set up, the app stands between you and your email, internal tools or a client system. That is a good position, but the app is only as good as the configuration behind it, which your employer controls.

Hardware authenticators are the other option the developer mentions, which is useful for people who would rather keep authentication off their phone entirely or who work in places where phones are restricted. Between a phone-based factor and a separate key, most organizations pick one as the default, so check with IT before assuming you can choose.

The app is free, carries no ads and offers no in-app purchases, which is consistent with something an employer deploys rather than sells to individuals. There is nothing to buy and no upsell to work around.

The most recent update contains only bug fixes, so there is no new capability to weigh in this release. For an app of this kind, that is a normal and unremarkable state of affairs.

What you need before it is any use

The requirement is explicit: your company has to be an RSA customer. Without that, the app has nothing to authenticate against, and the developer points people to their help desk administrator if they never received the details needed to register a device. That single condition is the whole gate, and it is worth checking before you spend time on setup.

The 3.3 average across more than 18,000 ratings is the other signal worth weighing. An app people are required to install tends to collect ratings from the moments it gets in the way, not the moments it works, so I would not read that number as a verdict on the technology.

There is also a practical dependency worth naming: the app is one half of a system. Your employer controls which authentication methods are available, when credentials expire, and what happens if you change phones.

If your organization is not an RSA customer, none of the above applies to you, and this app will not help with personal accounts or consumer services. It is built for the workplace, and it stays in that lane.

Who this suits

This is for employees, contractors and staff at organizations that already run RSA's authentication. If your IT department has told you to install it, the app does what you need: it turns your phone into the second factor for your work logins, with passkeys, prompts, codes and biometrics available depending on how your company has set things up.

It also suits administrators and security teams at those organizations, since the mix of methods gives them room to support different working conditions without issuing a different app to each group. Regulated industries, where proving who accessed what matters, are the target audience.

For anyone outside that circle, the app has no role. It is not a password manager for personal use, and it does not sign you in to consumer services. Judged on its stated purpose, it is a focused tool with a clear job.

A work-only authenticator that does its job

RSA Authenticator (SecurID) is worth installing if, and only if, your employer runs RSA and has asked you to enroll. In that case it is a straightforward, free utility that covers the full range of modern sign-in methods, from one-time codes and push approvals to device-bound passkeys, and it asks nothing of you beyond the registration details your help desk provides.

The 3.3 average and the 10 million plus installs describe an app that is widely deployed and not universally loved, which fits a tool people are required to use rather than one they seek out. The narrow requirement that your company be an RSA customer is not a flaw; it is the boundary of what the app is for.

If you are setting up work access on a new phone, install it, get the registration information from IT, and treat it as the piece of infrastructure it is. If you are looking for something to secure personal accounts, this is the wrong tool.

What's new in version 4.7.2.7

Bug Fixes