Google Authenticator

Google Authenticator Review: Cloud Sync Fixes Lost Phones, Not the Basics

Cloud Syncing or Use Without an Account: Decide Before Adding Codes

Until April 2023 every secret lived on a single handset, so a dead phone meant re-enrolling each service by hand. Signing in to a Google Account now copies your codes to every device where you sign in, and one install can hold codes for several Google Accounts. Google's help page says the codes are encrypted in transit and at rest; it does not call the sync end-to-end encrypted, the term Google's developer documentation does use for passkeys saved in Google Password Manager. If that gap matters, tap Use without an account on first launch: codes then stay on the phone, and switching later removes them from every Google Account. Deleting a synced code also wipes it from all your devices at once, so a mistaken deletion on one phone is never local.

Transfer Codes: Export on the Old Phone, Import on the New One

With sync on, signing in on a new phone is the whole migration. Device-only accounts move through Menu, Transfer codes, Export codes: the old phone asks to be unlocked, you tick the accounts to move, and it shows a QR code, possibly several when you move more than one account. Import codes on the new phone opens the scanner. The precondition is that both handsets work at the same moment. Google's lost-device advice is blunt: if codes were never synced, visit every site that used them, remove the old entry and enroll the new phone. Synced codes are cut off by removing the lost device from your Google Account. For the Google Account itself, keep a set of 10 single-use, 8-digit backup codes, because Google warns that recovery under 2-Step Verification can take 3 to 5 business days.

Time Correction Removed in Version 7.0, and What Reviewers Report

Google's help notes that the time correction setting disappeared in version 7.0, so codes now depend entirely on the phone's clock. Two of the most-upvoted Play reviews, with 2,611 and 1,814 helpful votes, describe codes that expire seconds after appearing and no in-app fix left to try. Sorting is manual too: you drag entries into place or search by username, with no alphabetical order or folders. Among the 150 newest English Play reviews, posted between September 21 and October 1, 2026, 43 gave one or two stars, citing QR scans that end in a Something went wrong message and, in a few cases, codes that vanished from the list. Reviewers writing in English, Spanish and Portuguese also report that pressing Back twice at the Privacy Screen fingerprint prompt opened the code list anyway.

Passkeys and Google Prompts Live Outside the App

Google's own 2-Step Verification help recommends Google prompts to anyone not using a passkey, and pitches Authenticator for times without an internet connection or mobile service. A passkey sign-in skips the second step entirely, and passkeys are stored in Google Password Manager rather than here; the app's best-practice list even ends by suggesting you enroll one. Google prompts arrive on Android phones signed in to your account, or on iPhones running Gmail, Google Photos, YouTube or the Google app, not inside Authenticator. Microsoft Authenticator handles push approvals itself, using number matching. Twilio Authy backs codes up to its own cloud, encrypted with a password Twilio never receives and cannot recover. What remains here is narrower: a free code generator that runs offline and, with sync on, survives a lost phone.