Google Authenticator

Is Google Authenticator safe?

Yes, as long as you treat your Google account as the key to all your codes. The app itself does one job well: it turns a secret from each website into a new six-digit code every 30 seconds, with no ads and no tracking on Apple's privacy label. The catch is the cloud sync Google added in April 2023. Your codes back up to your Google account, encrypted on Google's servers but not end to end, so anyone who takes over that account gets your second factor as well. We score it 74/100, below dedicated password managers such as Bitwarden and close to Microsoft Authenticator (76).

Is Google Authenticator sync end-to-end encrypted?

No. For years the app kept codes only on the phone, and losing the phone meant losing every code. Sync fixed that. Within a day of the launch, security researchers Mysk reported that the sync traffic was not end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary and that there was no passphrase option. Google's Christiaan Brand replied that Google encrypts data "in transit and at rest" and that "we have plans to offer E2EE for Google Authenticator down the line".

That was in April 2023. Google's help page, checked in October 2026, still says only that "Google encrypts Authenticator codes both in transit and at rest across our products". We found no announcement that end-to-end encryption has shipped. In practice this means Google can technically read the secrets, and so can anyone who gets into the Google account they sync to.

If you want synced codes that the provider cannot read, a password manager like 1Password can store them inside a vault encrypted on your device.

What the Retool attack showed

On 27 August 2023, an attacker texted a Retool employee a fake IT message, collected their password and a code on a phishing page, then rang them with a deepfaked voice posing as IT staff to get one more code. With access to the employee's Google account, the attacker had every code synced in Google Authenticator. Retool said 27 of its cloud customers were affected. The company accused Google of using "dark patterns" to push people into sync and said its administrators had no central way to switch the feature off.

The lesson is not that the app is broken. It is that sync turns two factors into one if the Google account is the weak point. Retool's employee would have been safer with codes kept on the device, or with a security key that cannot be phished.

What data does Google Authenticator collect?

Less than most Google apps. Apple's label lists coarse location, email address, user and device IDs, product interaction and diagnostics as linked to you, used for analytics, app functions and product personalisation. Nothing is marked for advertising and there is no "Used to Track You" section. The bigger privacy question is the synced secrets themselves, which are covered above. If you never sign in, the codes stay on your phone.

How to use Google Authenticator safely

1. Decide on sync deliberately. If you keep it, protect the Google account with a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary or security key, not just SMS.
2. If you would rather not sync, tap your profile picture and choose "Use Authenticator without an account". Google warns this removes the codes from your Google accounts and keeps them only on the phone.
3. Without sync, make a backup. In the app's menu, Transfer codes, then Export codes, turns your codes into a QR code you can scan onto a second phone, and most sites give printable backup codes when you set up two-step sign-in.
4. Turn on Privacy Screen in the app's settings, so the app asks for your PIN, pattern or biometric before it shows any code.
5. Never type a code into a page you reached from a text or email link. Real-time phishing kits ask for the current code and use it within seconds.
6. For your most important accounts, add a passkey or a hardware key. They cannot be phished the way six-digit codes can.

Who should be careful

People who use Google Authenticator for work accounts, especially on a personal Google account, carry the Retool risk: one phished Google sign-in can open the company VPN too. Ask your IT team whether codes should sync at all. People at higher risk of targeted attacks, such as journalists and campaign staff, should prefer security keys for both the Google account and the services behind it.

How we scored it

Apart from the regulatory record, scams and harmful content (84) is the strongest factor: there is no content and no contact with strangers, only phishing to watch for. Privacy (70) and security (70) are held back by sync without end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, more than three years after Google said it would add it. The regulatory record (88) reflects no action that names the app; Google's privacy fines over other services, such as Gmail, do not count here.