Google Authenticator explained: how its 2FA codes work

Every 30 seconds or so, a short number on your phone changes, and a website you never showed that phone to somehow knows what the new number should be. It looks like magic, but it’s a simple shared-secret trick.

That’s how Google Authenticator and similar apps work. Here’s how the codes are generated, why they work without an internet connection, how the app relates to Google’s own 2-Step Verification, and what it can and can’t protect.

How the codes are generated

When you add an account to an authenticator app, the service gives you a secret, usually as a QR code or a setup key, and the app stores it. From then on, the service and your phone both hold the same secret. To produce a code, the app combines that secret with the current time, and the service does the same calculation on its side. If the two results match, the code is accepted.

This method is a published standard called TOTP, short for time-based one-time password, defined in IETF RFC 6238. It builds on an older counter-based method, replacing the counter with a value derived from the time. The standard says the app and the service must use the same time step, and it recommends a default of 30 seconds, which is why the code usually refreshes about twice a minute.

Why it works without an internet connection

The code is calculated on your phone from the stored secret and its clock, so nothing needs to be sent to the phone. Google’s own app listing says codes can be generated even without a network or cellular connection. The service only needs to run the same calculation when you submit the code.

The consequence is that the clock matters. If the time on your phone is far from the real time, the two calculations won’t match and the code will be rejected, even though the app is working as designed.

How it relates to Google’s own 2-Step Verification

The two are easy to confuse. 2-Step Verification is the feature on a Google Account that asks for a second step when you sign in. Google Authenticator is an app that can provide that step, and, according to Google, it can also generate codes for other sites and apps that support authenticator-app verification. Several other authenticator apps follow the same standard, so the codes themselves aren’t tied to one company.

You can use the app with or without a Google Account. Signing in lets your codes sync across your devices, and Google says that without an account you can still transfer them manually to a new device. Synced codes depend on that Google Account, so its own protection matters more. Google also suggests setting up additional forms of 2-Step Verification so you don’t lock yourself out.

What it protects, and what it doesn’t

According to CISA, codes from an authenticator app are better than text messages, but they are still vulnerable to phishing. A convincing fake login page can capture a code as you type it and use it immediately, and only FIDO-based methods such as security keys and passkeys resist that. Checking the address of a site before entering a code is part of the protection.

The secret behind your codes is also sensitive. Whoever has the QR code or setup key can generate the same codes, so a screenshot of it should be treated like a password. And an authenticator app guards accounts that sign in through a service. It can’t protect a wallet’s seed phrase or private key.

WEEX Reminder: treat the setup key like a password

WEEX reminds users never to share a one-time code, a QR code, or a setup key with anyone, including people who claim to be support, since a genuine service never needs them. Check the address of a site before entering a code, and keep any backup key or backup codes somewhere safe and offline, not as a screenshot or a cloud note. Nothing here is financial advice.

Conclusion

Google Authenticator generates a short-lived code from a secret shared with the service and the current time, which is why it works offline and why the clock matters. It’s one app among several that use the same standard, it is better than text messages but still phishable, and its setup secret deserves the same care as a password. Used alongside strong passwords and careful habits, it makes an account harder to take over.

FAQ

1. What is Google Authenticator?
It’s an app that generates one-time codes used as a second step when you sign in, for Google Accounts and for other sites and apps that support authenticator-app verification.

2. How does Google Authenticator generate codes without internet?
It calculates them on your phone from a stored secret and the current time. The service runs the same calculation to check the code, so nothing needs to be sent to your phone.

3. Do I need a Google Account to use Google Authenticator?
No. Google says you can use it without an account. Signing in lets your codes sync across devices, and without an account you can transfer them manually to a new device.

4. Is Google Authenticator the same as Google’s 2-Step Verification?
No. 2-Step Verification is the feature on a Google Account, and the app is one way to provide the second step. The app also works with other sites that support authenticator-app codes.

5. Is Google Authenticator safer than SMS codes?
According to CISA, authenticator-app codes are better than text messages, but they can still be phished. Security keys and passkeys offer stronger protection against phishing.