Google Authenticator: how to turn on two-step verification?
Protect your domain, hosting or email account with a code from an app on your phone. A password alone won’t be enough for anyone to sign in.
Added:
What is Google Authenticator?
One-time codes for two-step verification that work without internet or mobile service.
- An app from Google for Android and iPhone, published by Google LLC.
- More than 100 million downloads on Google Play.
- Gives one-time sign-in codes for websites and apps that support them.
Why do we choose Google Authenticator?
- The code is created on your phone, so it works even without internet or mobile service.
- The code doesn’t arrive as a text, so someone who takes over your phone number can’t get it.
- One app handles many accounts: your domain, hosting and email.
- You can save your codes to your Google Account, so they don’t disappear when you change phones.
Work with AI
Pick an assistant. It opens with a ready prompt and walks you through this guide step by step.
ChatGPT (opens a new tab with a ready prompt)
Claude (opens a new tab with a ready prompt)
Gemini (copies the prompt and opens a new tab, paste it into the chat)
Perplexity (opens a new tab with a ready prompt)Help me follow the guide “Google Authenticator: how to turn on two-step verification?” from PerfoState: https://perfostate.com/guides/google-authenticator/ Open this page and read the whole guide. Walk me through it point by point: describe one step, wait until I say it is done, and only then move on. If the guide has several paths, first ask which one fits my situation. Do not guess steps that are not on the page. If you cannot open the page, say so directly. If something does not work or the screen looks different from the guide, check the official Google Authenticator help (https://support.google.com/accounts/answer/1066447?hl=en) and tell me what changed. If I am still stuck, suggest contacting PerfoState: website https://perfostate.com/#contact. Never ask me for passwords. Answer in English, briefly and in plain words.
Names and logos belong to their owners. We are not affiliated with OpenAI, Anthropic, Google or Perplexity.
1Install the app
Download Google Authenticator for iPhone from the App Store (opens in a new tab) or for Android from Google Play (opens in a new tab).
- Check that the publisher is Google LLC. The stores have similar apps from other companies.
- On Android you need version 6.0 or later, on iPhone the latest version of iOS.
- When you open the app, tap “Get Started” and sign in to your Google Account. Your codes are then saved to that account.
- Prefer not to use a Google Account? Tap “Use without an account”. Your codes then stay only on this phone.
2Turn on two-step verification in the service
Sign in on your computer to the account you want to protect and open its security settings.
- Look for two-step verification, 2-step verification or 2FA.
- When the service asks for a method, choose an authenticator app, not codes sent by text.
- The service shows a QR code. Keep it on your computer screen.
Check the source: Google help on 2-Step Verification, as of October 15, 2026 (opens in a new tab)
3Scan the QR code
Open Google Authenticator, tap the plus button, then “Scan QR code”.
- Allow the app to use the camera. It needs it only to scan QR codes.
- Point the camera at the QR code on your computer screen.
- A new entry appears in the list: the service name, your username and a 6-digit code.
- Is the QR code on the same phone? Show the key in the service instead and, after tapping the plus button, choose to enter the key.
4Confirm the code in the service
In the service, enter the 6 digits the app now shows for the new entry and confirm.
- The code changes every 30 seconds. Next to the code, the app shows how much time it has left.
- When time is almost up, wait for the new code and enter that one.
- Code not accepted? Check that your phone sets the date and time automatically.
Check the source: QR code format in the Google Authenticator repository, as of October 15, 2026 (opens in a new tab)Check the source: Google help on the Google Authenticator app, as of October 15, 2026 (opens in a new tab)
5Save the backup codes
If the service shows backup codes, save them right away.
- Print them or save them in a password manager.
- Each backup code works only once.
- They let you sign in if you lose your phone.
- Don’t take a screenshot of the QR code and never send it to anyone.
Check the source: Google help on backup codes, as of October 15, 2026 (opens in a new tab)
6Name the entry and test signing in
Swipe the entry left in the app to edit it, and enter a name you will recognize.
- For example: Cloudflare yourcompany.com.
- Each account has its own entry in the app. You add it once, when you turn the feature on.
- Sign out of the service and sign in again. After your password, the service asks for the code from the app.
Has two-step verification been turned on yet?
No rush. Go back to the list of steps or email us: we’ll go through it together.
Done. From now on, signing in takes your password and a code from your phone. Never share your codes or backup codes with anyone, including us: we never ask for them.
Questions about two-step verification
How does the code from the app work?
The QR code contains a secret key for the service, which the app saves on your phone. From this key and the current time, the app calculates a new 6-digit code every 30 seconds. The service has the same key, so it calculates the same code and simply compares the two. That is why the code works without internet or mobile service. Check the source: QR code format in the Google Authenticator repository, as of October 15, 2026 (opens in a new tab)Check the source: Google help on 2-Step Verification, as of October 15, 2026 (opens in a new tab)
Why an app and not codes sent by text?
A code from the app is created on your phone and is never sent anywhere. A code sent by text goes to your phone number, and Google warns that such codes can be vulnerable to phone number-based hacks, such as a SIM swap. A text also won’t arrive without mobile service. So choose codes by text only when the service offers no app. Check the source: Google help on 2-Step Verification, as of October 15, 2026 (opens in a new tab)
Can I share a code with someone?
No. Codes from the app, backup codes and the QR code are for you only, and we never ask for them. Anyone who asks for a code in a call, a text or an email is most likely trying to get into your account. A code works only briefly, but that is enough to sign in. Check the source: Google help on backup codes, as of October 15, 2026 (opens in a new tab)
Why should I never save or send the QR code?
The QR code and the key work like a password: whoever has them can add your account to their own phone and see the same codes. So don’t take a screenshot and don’t send them to anyone. If someone may have seen them, turn two-step verification off in the service and turn it on again with a new QR code. Check the source: QR code format in the Google Authenticator repository, as of October 15, 2026 (opens in a new tab)
The code doesn’t work. What should I do?
Check that you are entering the current code from the entry for the right service and account. Also check that your phone sets the date and time automatically. The app calculates codes from your phone’s clock, so a wrong time gives wrong codes. If needed, sign in with a backup code. Check the source: Google help on the Google Authenticator app, as of October 15, 2026 (opens in a new tab)
How do I move my codes to a new phone?
If your codes are saved to your Google Account, install the app on your new phone, tap “Get Started” and sign in to the same account. Your codes appear on their own. Without a Google Account, on your old phone tap the menu > “Transfer codes” > “Export codes”, select the accounts and tap “Next”. On your new phone tap the menu > “Transfer codes” > “Import codes” and scan the QR code from your old phone. Delete the app from your old phone only once the codes work on the new one. Check the source: Google help on the Google Authenticator app, as of October 15, 2026 (opens in a new tab)
What should I do if I lose my phone?
Erase your phone remotely as soon as possible: Android and iPhone both have this option. If your codes are saved to your Google Account, remove the lost phone from that account. Sign in to your services with backup codes, then in each one remove the old phone and add the new one with a QR code. No backup codes? Use the account recovery of that service or email us and we will help. Check the source: Google help on the Google Authenticator app, as of October 15, 2026 (opens in a new tab)
Can one app handle many accounts?
Yes. Each service has its own entry with its own code in the app. You can also turn on “Privacy Screen” (menu > “Settings” > “Privacy Screen”). The app then asks for your PIN, fingerprint or face before it shows your codes. Check the source: Google help on the Google Authenticator app, as of October 15, 2026 (opens in a new tab)