Authenticator Apps and App Passwords: How They Work

An authenticator app produces time-based one-time passwords, a method usually called TOTP. When you turn on app-based two-factor authentication, the service shows a QR code. That code contains a secret key, and scanning it stores a copy of the key inside your app. From then on, the service and your phone share the same secret, and it never needs to travel over the network again.

To create a code, the app combines the secret with the current time, rounded to a short interval that is usually 30 seconds, and runs the result through a standard cryptographic function. It then trims the output into a short number, typically six digits. The server performs the same calculation on its side and compares the two results. Because both sides only need the secret and a clock, the app works without mobile data or Wi-Fi.

This design explains the most common problem: codes that are rejected even though you typed them correctly. If your phone's clock drifts, it calculates codes for the wrong time window. Setting the date and time to update automatically usually fixes it, and some apps also include a time correction option.

Any app that supports the standard TOTP method works with most services, so the real choice comes down to how the app handles your secrets. The large platform companies offer their own apps, Google Authenticator and Microsoft Authenticator among them, and many password managers can store TOTP codes as well.

Look for a way to back up or export your codes, because an app that keeps them on one phone only turns a lost phone into a lockout. If the app syncs to a cloud account, make sure that account is itself well protected, and prefer apps that encrypt the backup. An app lock with fingerprint, face or PIN adds protection if someone picks up your unlocked phone.

Some authenticator apps also offer push approvals for their own company's accounts, where you tap to confirm a sign-in instead of typing a code. That is convenient, but it only works with that provider. For every other service, the app behaves like a standard code generator.

In the account's security settings, choose the option to set up an authenticator app. Scan the QR code with the app, or type the setup key by hand if you cannot scan. The service then asks for the current code to prove that the setup worked. Do not skip this step, and do not close the page until the code has been accepted.

Give each entry a clear name if the app allows it, especially when you manage several accounts on the same service. An entry that only shows the brand name is easy to confuse with another one, and deleting the wrong entry can lock you out.

Save the backup or recovery codes the service offers at the same time. They are the simplest way back in if the phone with your authenticator is lost before you have made a backup of your codes.

The safest rule is simple: set up the new phone while the old one still works. Do not wipe, sell or trade in the old device until every code has been moved and tested.

Many authenticator apps include a transfer or export feature that shows one or more QR codes on the old phone for the new phone to scan. Others restore your entries from an encrypted cloud backup when you sign in on the new device. After moving, sign in to a few accounts with the new codes to confirm that they match.

If your app has no transfer option, move the accounts one at a time. Sign in to each service, open its two-factor settings, choose to add or change the authenticator, scan the new QR code with the new phone and confirm the code. On many services the old entry stops working once the secret is replaced, so delete it afterwards to avoid confusion. Keep your backup codes nearby during the move in case something goes wrong halfway through.

An app password is a long, randomly generated password that lets one specific app or device sign in to your account without going through two-factor authentication. It exists for older software that only understands a username and password and cannot show a code prompt or open a sign-in page.

Google, Microsoft and Yahoo accounts, among others, let you create app passwords from the account's security settings, in most cases only after two-step verification has been turned on. Some account types, such as certain work or school accounts or accounts enrolled in the strictest security programs, may not offer them at all. You normally see each app password only once, when it is created, so paste it into the app straight away.

Because an app password skips the second factor, treat it like a full password to the mailbox it protects. Create a separate one for each app or device, give it a descriptive name where the service allows, and never reuse it anywhere else.

Modern email apps sign in to the big providers through a browser-style sign-in window that handles two-factor authentication directly, so they do not need an app password. You typically need one only when a program or device connects with plain IMAP, POP or SMTP settings and a simple password field: older desktop mail clients, some mobile mail apps, scanners and printers that send email, backup tools, scripts and older smart devices.

A good test is to try the normal sign-in first. If the app opens the provider's own sign-in page, use it. If it only offers server settings and keeps rejecting your correct password after you enabled two-step verification, that is the signal to create an app password, enter it in place of your normal password and leave the other settings unchanged.

Providers have been steering people away from plain password sign-in for third-party apps, so an app password that works today may stop being supported later. When a program you rely on stops connecting, check whether a newer version supports the modern sign-in method before creating yet another app password.

Review your app passwords from time to time in the account's security settings and revoke any you no longer use, especially for devices you have sold or programs you have uninstalled. Some providers list each app password separately, while others only let you remove them all at once. On some services, changing your main password also revokes existing app passwords, so be ready to create new ones afterwards.

If you received an email account from someone else, for example through a digital goods marketplace such as rStock, remove any app passwords and authenticator entries you did not create, then set up your own authenticator and generate fresh backup codes. On rStock the delivered content appears on your order page as a delivery record linked to the order, so copy the details into your password manager before you start changing them. Use any account you obtain in line with the provider's terms of use, and note that rStock is not affiliated with Google, Microsoft, Yahoo or any other provider named in this article.

Finally, keep your authenticator app, backup codes and app passwords apart from each other where possible. A single stolen phone or leaked note should never be enough to hand someone every key to your mail.