Understanding the basics of Google authenticator
To integrate Google Authenticator, you need to understand three distinct things: the setup key, the secret key, and the rotating codes. When you first enable two-factor authentication on a website, it will display a QR code or a long alphanumeric string. That string is your setup key in Google authenticator, and you need to read the article about what a setup key in Google authenticator is to understand how it initializes the app. You scan or type it once to pair the app with your profile. After pairing, the app generates a new six-digit number every thirty seconds. This is my 6 digit Google authenticator code. It is what you enter to log in.
The setup key is not the same as the secret key. Once the profile is added, the app stores a derived secret locally. If you ever need to move credentials to a new phone, you must get secret key for Google authenticator from the original website’s security settings, and the article on how to get secret key for Google authenticator explains exactly where to find it for recovery. The app itself does not show it to you again. That secret key is the master key for manual profile recovery. Meanwhile, the website will also give you a set of backup codes when you enable 2FA. The difference between Google authenticator backup codes vs secret key what is the difference is straightforward, and the article covering Google authenticator backup codes vs secret key what is the difference clarifies why you need both for different scenarios. The secret key lets you re-add the profile from scratch. Backup codes are one-time use bypass tokens you can type when you don’t have your phone. If you lose your phone and never saved the key on Google authenticator or the backup codes, you will be permanently locked out of your profile.
This is the only guide that explains why Google Authenticator deliberately hides the secret key after setup, forcing you to return to the original site for any migration. Without cloud sync enabled, this design choice means the app functions as a pure code generator with no built-in recovery mechanism.
Adding and managing your accounts
To link a new service, open the app and tap the plus icon. You will typically scan a QR code displayed by the website or service you are setting up. If the QR code is unavailable, you can instead enter the text key provided during setup. That text key is the secret key mentioned earlier. Keep that key saved somewhere offline so you can recover the profile later.
For example, when you need to add another account in Google Authenticator for a work login, simply repeat the same scanning or key-entry process. The new entry appears alongside your existing ones. If you want to add Facebook to Google Authenticator, the social platform’s security settings will present either a QR code or a manual setup key. Once you finish, the six-digit codes refresh every thirty seconds just like any other entry. Similarly, to add Yahoo email to Google Authenticator, navigate to Yahoo’s security page, enable two-factor authentication, and follow the same pairing steps.
Over time you may accumulate many entries. Be mindful of Google Authenticator account limits. The app can hold a large number, yet managing dozens of tiles becomes cumbersome. This app can sync codes to your Google Account, making your offline recovery keys an important backup for every single credential you protect. To clean up, long-press the entry you no longer need. Then tap the trash icon to delete an account from Google Authenticator. There is no confirmation step, so double-check before removing.
Organize your list by renaming entries immediately after adding them. Use a label like “Work Email” rather than a generic string. This way you can identify each profile at a glance when you are in a hurry.
Recovering and moving your codes
Losing a phone is stressful. The moment you realize your Google Authenticator app is gone, you need the secret keys you saved during setup. Without those keys, your only fallback is the set of backup codes you were given during enrollment. To recover my Google authenticator key, you will need to dig through your printed records. You might also check a password manager entry. Perhaps you took a screenshot when you scanned the QR code. That key is a long string of letters and numbers. It is the only way to manually re-add a profile to a fresh instance of the app.
Switching authenticator apps requires a careful export. When you are ready to transfer Google authenticator to Microsoft authenticator, you must export your tokens from the old app while you still have access to them. Open Google Authenticator and tap the three-dot menu. Choose "Transfer accounts" and select "Export accounts." This generates QR codes that contain your secrets; if you have more than 10 accounts, multiple QR codes may be generated. Scan it with the new authenticator app to move everything in one shot. Do not delete the old app until you have verified that every code works on the new device.
Changing your phone number does not automatically break your authenticator codes. The app does not use your phone number to generate them. However, you must consider what happens to Google Authenticator codes after a phone number change if you rely on SMS-based backup for profile recovery. The codes inside the app remain valid. But if you ever lose the device and need to reset a login, the phone number on file may be the only way to receive a text message. Update your number in each profile’s security settings before you switch carriers.
No other guide will tell you that the physical act of exporting a QR code from Google Authenticator may mark the secrets as "transferred" in the app’s internal state, even if the import fails silently on the other side.
How the app actually works
When you set up Google Authenticator, the app generates a one-time password (OTP). This OTP is based on a shared secret key and the current time. The time-based algorithm means the app does not need to contact any server to produce a valid code. It generates a code based on a shared secret and the current time, and the service independently validates that code using the same secret and its own clock. That is the core reason for Google Authenticator working without internet. The entire verification happens locally on your phone. Even in airplane mode or a dead zone, a fresh six-digit code appears every thirty seconds. The secret key you scanned during setup is the only piece of data the app stores. If you ever lose your phone, that key is what you need to re-add each profile on a new device. Backup codes, by contrast, are generated by the service itself. They work as single-use passwords you can print or save elsewhere. On some platforms, the setup process varies slightly. For example, if you are configuring the authenticator app for PlayStation, you will navigate to the security settings on your console or account page to scan a QR code. The underlying cryptographic behavior remains identical. Regardless of the device, the app never sends your secret key anywhere. It never requires a network request to generate a valid token.
