# google-authenticator

Source: https://startwithidentity.com/vendors/mfa/google-authenticator/
Last updated: 2026-06-19
License: content by Start with Identity. Cite the source URL.

---

## Overview

Google Authenticator is a free mobile app that generates time-based one-time passcodes ([TOTP](https://startwithidentity.com/glossary/mfa/)). It launched in 2010 and is one of the most widely used second-factor apps in the world, supported by nearly every site and service that offers [MFA](https://startwithidentity.com/glossary/mfa/). It is not an identity platform or an enterprise product. It is a single-purpose code generator that stores the shared secrets for your accounts and shows a rotating six-digit code.

## What it is good at

It is free, simple, and universally supported. Setup is a quick QR-code scan, and the app now backs codes up to your Google account so you do not lose them when you replace a phone. For protecting personal accounts, a TOTP app is a large step up from SMS codes and from passwords alone, and Google Authenticator does that job cleanly with no cost and no account friction.

## Where it falls short

TOTP is a shared-secret scheme, which means the code can be phished. An attacker who runs a convincing fake login page can capture the six digits in real time and replay them, so this is not [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/). There is no admin console, no provisioning, no policy engine, no reporting, and no centralized recovery. It cannot enforce anything across a workforce. It is a consumer tool, full stop.

## Pricing

Free. There is no paid tier and no enterprise edition, because it is not an enterprise product.

## Best for, and who should look elsewhere

Choose it for personal accounts and for the smallest teams that just need a free second factor. Organizations that need policy, lifecycle, reporting, or phishing resistance should look at a real platform: [Microsoft Authenticator](https://startwithidentity.com/vendors/mfa/microsoft-authenticator/) if you live in Entra ID, [Duo](https://startwithidentity.com/vendors/mfa/duo/) for managed workforce MFA, or [Yubico](https://startwithidentity.com/vendors/mfa/yubico/) and other [FIDO2/passkey](https://startwithidentity.com/standards/webauthn-fido2/) options for phishing resistance. See the full [MFA directory](https://startwithidentity.com/vendors/mfa/) and the [how-to-choose guide](https://startwithidentity.com/guides/buyer-guides/how-to-choose-an-mfa-solution/), and model workforce cost with the [TCO calculator](https://startwithidentity.com/tools/tco-calculator/).

## Bottom line

A free, universal TOTP app that is great for personal use and useless as an enterprise control. Treat it as self-defense, not as a security program.