The key on Google Authenticator is the secret key, also called a setup key or seed, that acts as a shared secret between your device and the service you are securing. This key powers the Time-Based One-Time Password (TOTP) algorithm, which uses it along with the current time to generate a new six-digit code every 30 seconds, proving you have the authorized device.
What is the key on Google Authenticator?
The key on Google Authenticator is a unique, randomly generated string of characters that establishes a secure link between your app and the service provider. It is the foundation of the two-factor authentication process. During setup, this shared secret is exchanged between your device and the service, and you can get secret key for Google authenticator to manually back it up or transfer it to a new phone. The Google Authenticator app then uses the TOTP algorithm to combine the key with the current time, producing a one-time password that changes every 30 seconds. Because the key is stored locally on your device and never transmitted over a network, it remains safe even if the service's server is compromised. Each account you add has its own unique key, ensuring codes cannot be used interchangeably between services.
Where to find the key during setup
When you set up Google Authenticator for an account, you obtain the key through one of two methods provided by the service. The service displays the key either as a QR code or as a manual string of characters.
- Scan the QR code using the Google Authenticator app. The app reads the key directly from the code and configures the account automatically.
- For manual entry, you select "Enter a setup key" (or similar) in the app, then input your account name (e.g., email address) and the provided secret key, ensuring "Time based" is selected.
Once you complete either method, the app generates a six-digit code. Enter this code on the service's login page to finish the setup. The key itself is only visible during this initial process; after setup, it is stored securely within the app.
Why you can't see the key after setup
After you add an account to Google Authenticator, the app hides the key by design. This security measure prevents anyone who gains access to your device from extracting the seed locally. If you lose your phone, you cannot recover the "seed" or secret key from the Google Authenticator app itself. The app does not provide an option to view or export the key once setup is complete, protecting the shared secret from exposure even if the device is compromised.
What to do if you lose the key
If you lose access to the key, for example, by losing your phone or deleting the app, recovery depends on the type of account. For third-party accounts (non-Google services), you would need to reset the third-party accounts by disabling and re-enabling two-factor authentication through the service's website. For Google accounts, you can use backup codes that were generated during the initial setup. If you saved the key or QR code during setup, you can re-enter it on a new device. This is why you would want to integrate Google Authenticator carefully: saving the setup key in Google Authenticator during initial setup ensures you can restore access later. The most reliable recovery method is to have saved the key or backup codes in a secure location like a password manager, because the app itself cannot regenerate or display the seed after setup.
