Why You Should Use an Authenticator App: A Plain English Guide for Non-Techies

If you’re reading this, you’ve probably heard that using something called an “authenticator app” can make your online accounts more secure, especially more secure than SMS MFA, as described in our last article. You might be wondering, “Do I really need another app on my phone just to log in?” The short answer is Yes—if you care about keeping your accounts secure. And, of course, you care… that’s a no-brainer.

The goal of this article is to explain what authenticator apps are, how they work (in the simplest way possible), and why they’re much safer than getting a code by text message. This is not meant to be a “how-to” when it comes to setting up authenticator apps, there are plenty of resources on the web for that.

Multi-factor authentication (MFA) is just a fancy way of saying “more than one way of proving you are who you say you are.” This is important because even if someone steals your password, they still can’t get into your account without it. This simple extra step makes a big difference in keeping your accounts secure.

Why Should You Use an Authenticator App?

All of us rely on passwords to access our accounts. But here’s the problem:

• Passwords are easy to steal. Hackers use techniques like phishing (tricking you into giving up your password) or data breaches (where they grab thousands of leaked passwords from companies).
• Most people reuse passwords. You might use the same or similar passwords for multiple sites. If one account gets hacked, it puts other accounts at risk.
• A lot of passwords are weak. People tend to use weak passwords they can remember and type easily. Please see our previous article on how to create strong passwords.

This is where Multi-Factor Authentication (MFA) comes in. As mentioned above, no one can access your account without both your password and the code created by the app (described in more detail below).

How Do Authenticator Apps Work? 

An authenticator app is a small program that typically runs on your phone. When you turn on MFA for an account (like your email or bank), it asks you to scan a QR code using the app. This QR code holds a special “secret key” that’s shared between the app and the website.

Here’s how it works step by step:

1. The app and website sync up using that shared key.
2. Every 30 seconds, the app generates a new temporary code using that key.
3. When you log in, the website asks for your password and the current code from the app.
4. If the code matches the one the website expects, you’re in.

It’s like the bouncer at the club not just knowing the secret password but also some secret about you (you know, from that one time…)

What Does an Authenticator App Look Like?

You might wonder what these apps look like if you have never used one. Here you go:

Google Authenticator:

Microsoft Authenticator:

Pretty exciting, huh? These apps usually have a simple interface showing a list of your accounts and the code you need. Each code is updated every 30 seconds, making it quick and easy to use during login.

You can usually copy and paste this code if you are logging into a site on the same device.

Why Are Authenticator Apps More Secure Than Text Message (SMS) MFA?

You might already use SMS MFA—that’s when a website sends a temporary code to your phone via text message. While this is better than nothing, it’s not as secure as using an authenticator app. We discussed the reasons why law enforcement and the Department of Homeland Security want you to stop using SMS MFA in this article.

Authenticator apps don’t rely on your phone number, so they avoid these risks entirely.

What Are the Risks of Using Authenticator Apps?

No security method is perfect, and authenticator apps have their own potential downsides. Here’s what to watch out for:

• Losing Your Phone: If you lose your phone, you might lose access to your accounts.
  How to protect yourself: Many apps, like Microsoft Authenticator and others, offer cloud backup. You can also save backup codes when you set up MFA—these codes can help you log in without the app.
• Malware Threats: If a hacker installs malware on your phone, they could gain access to the authenticator app.
  How to protect yourself: Keep your phone updated and use antivirus software if possible.
• No Push Notifications (in Basic Apps): Unlike SMS MFA, most authenticator apps don’t send a notification when someone tries to log in. You have to open the app and manually enter the code.

Which Authenticator App Should You Choose?

There are several well-known authenticator apps, but for the purposes of this article, we are going to recommend keeping it simple and going with Google or Microsoft. If you decide to get a password manager (you should) and/or hardware keys (another great option), then you may want to look into the authenticators that come with those.

Why YubiAuthenticator Is a Good Option for YubiKey Users

If you are reading this article, this probably does not apply to you. But, if you already use a YubiKey (a small hardware device for MFA), then the YubiAuthenticator app might be a great fit. Here’s why:

• You can run it on your desktop, which makes it super easy to copy and paste codes. A real game-changer.
• YubiAuthenticator generates temporary codes, just like other apps, but requires your YubiKey to do it.
• This means a hacker would need both your password and your physical YubiKey to get in.
• It’s ideal for people who prioritize maximum security, such as IT professionals or businesses handling sensitive data.

Are Authenticator Apps Here to Stay?

Yes—at least for the foreseeable future. While new login methods, like fingerprints, facial recognition, passkeys, and hardware-based MFA, are growing in popularity, passwords are still widely used. Authenticator apps will play a key role in keeping our accounts secure as long as we rely on passwords.

Looking ahead, we can expect improvements in:

• Ease of use: More apps may offer push notifications or automated code entry.
• Backup and recovery: Cloud sync and recovery options will likely become more seamless.
• Integration with hardware keys: Apps like YubiAuthenticator show how combining physical keys with apps can enhance security.

Conclusion: Take Control of Your Online Security Today

Take the first step toward securing your digital life—enable MFA with an authenticator on your accounts today. It’s a small effort with a big payoff in online safety.

Whether you go with Google Authenticator, Microsoft Authenticator, or even a hardware-based option like YubiAuthenticator, the key is to get started and keep hackers out.

If you would like help getting your business set up with more effective security, please reach out to ViaTek. You can email us at sales@viatek.net or call (303) 664-1182.

Previous Articles in This Series:

• Why the FBI and CISA Recommend Against SMS-Based Multi-Factor Authentication (MFA)
• An Introduction to Hardware Keys
• An Introduction to Biometric Authentication
• An Introduction to Passkeys