An authenticator app is an app on a phone, and sometimes a computer, that stores or receives the credentials and approvals used to verify a user’s identity at sign-in. Most generate time-based one-time passwords (OTP) that change every 30 seconds or so; many also receive push notifications the user approves; and some can now store passkeys. Their codes are most commonly used as the second factor in two-factor authentication (2FA), replacing codes sent by text message; whether push approvals or passkeys act as a second factor or as a passwordless first step depends on the identity provider and how sign-in is set up.
At a glance
- Generates time-based codes (TOTP) from a secret set up by scanning a QR code; works offline.
- Many identity providers’ apps also support push approvals, often with number matching or sign-in details shown.
- Some apps can also hold passkeys or work with phone biometrics.
- Safer than SMS against SIM swaps, but codes and push approvals can be phished, and push can be abused through MFA fatigue.
- Phone replacement and loss are the main support burden; plan backup and recovery.
What problem it solves
Text-message codes depend on the phone network, which attackers can redirect through SIM swaps or number porting fraud, and they don’t work without signal. An authenticator app keeps the code generation on the user’s device, independent of the carrier, and works offline.
Push approvals go a step further for convenience: the user taps to approve instead of typing a code. For IT, a single app standard for staff simplifies enrollment and support compared with a mix of SMS, email and token methods.
How it works
Time-based codes. When a user enrolls, the service shows a QR code containing a shared secret. The app stores the secret and combines it with the current time to compute a short code, following the TOTP algorithm in RFC 6238. The service performs the same calculation and compares. Because the algorithm is open, one app can hold codes for many unrelated services.
Push approvals. The app registers with a specific identity service. At sign-in, the service sends a notification to the app, and the user approves or denies. Better implementations require number matching, where the user types a number shown on the login screen, and display the application, location or device requesting access.
Passkeys and biometrics. Some apps can store passkeys or require a fingerprint or face scan before approving, adding a local check that the right person holds the phone.
Backup and transfer. Apps differ in whether codes can be backed up to a cloud account or moved to a new phone. Backups help recovery but make the backup account a target. Some password managers can also store TOTP secrets, which is convenient but puts the password and second factor in one place.
Device management. Organizations can require the app to run on managed or compliant devices, using mobile device management (MDM) and identity provider policy.
When it matters for buyers
- When moving off SMS. Authenticator apps are the usual next step and are often included in identity provider licenses.
- When deciding on push. Require number matching and sign-in context; plain approve/deny prompts invite fatigue attacks.
- For high-risk users. App codes and push are not phishing-resistant MFA; administrators often need keys or passkeys.
- When staff use personal phones. Decide on policy and alternatives, such as company phones or security keys, before rollout.
- When planning recovery. New phones are routine; define how users re-enroll and what identity checks the help desk performs.
- For insurance and audit questionnaires. Be ready to list which methods are enabled for which users.
Questions to ask vendors
- Does your app support TOTP, push with number matching, and passkeys, and on which license tiers?
- Can we require number matching and show sign-in context on push approvals?
- Can we restrict the app to managed or compliant devices?
- How are codes and push registrations backed up or moved to a new phone, and can we control that?
- What alternatives do you support for staff without a smartphone?
- What logs show denied or unexpected push requests, so we can spot attacks?
How it differs from a password manager
A password manager stores and fills in passwords and other credentials; an authenticator app holds or receives the codes, approvals and sometimes passkeys used to verify a sign-in, most often as a second factor. Some password managers also generate TOTP codes, and some authenticator apps store passkeys, so the lines blur. The main concern is separation: if the password and the code live in the same app and that app or its account is compromised, both factors fall together. For managing the phones these apps run on, see our unified endpoint management overview.