Google Authenticator
A mobile app that generates TOTP codes (6-digit codes that change every 30 seconds) for two-factor authentication.
What is Google Authenticator?
Google Authenticator is a free mobile application that implements the TOTP (Time-Based One-Time Password) standard (RFC 6238) for two-factor authentication. The app generates 6-digit codes that automatically refresh every 30 seconds, providing a second factor of authentication beyond passwords.
Unlike SMS OTP, Google Authenticator works offline - it doesn't require cellular service or internet connectivity. The app synchronizes with the server using a shared secret key and the current time, generating matching codes independently on both sides.
While Google Authenticator was created by Google, it works with any service that supports TOTP (including GitHub, AWS, Microsoft, Dropbox, and LoginRadius). The app is available for iOS and Android, and there are many alternative TOTP apps (Authy, Microsoft Authenticator, 1Password).
Analogy
Think of Google Authenticator like a digital watch that displays a new 6-digit code every 30 seconds. Even if someone steals your password, they can't log in without the code currently showing on your watch - and that code changes so fast they can never guess the next one.
Types and Use Cases
- Consumer Apps: Add TOTP as second factor for user accounts (GitHub, Gmail, AWS Console)
- Enterprise SSO: Require Google Authenticator for admin accounts and VPN access
- Gaming Platforms: Protect gaming accounts from hijacking with TOTP
- Cryptocurrency Exchanges: Use TOTP for withdrawal authorization and account changes
How it Works
// TOTP Generation (Simplified)
function generateTOTP(secret, timeStep = 30) {
const timeCounter = Math.floor(Date.now() / 1000 / timeStep);
const hmac = crypto.createHmac('sha1', Buffer.from(secret, 'base32'));
hmac.update(Buffer.from(timeCounter.toString(16).padStart(16, '0'), 'hex'));
const digest = hmac.digest();
const offset = digest[digest.length - 1] & 0xf;
const code = (digest.readInt32BE(offset) & 0x7fffffff) % 1000000;
return code.toString().padStart(6, '0');
}
// Example: Code changes every 30 seconds
// Time: 12:00:00 → Code: 123456
// Time: 12:00:30 → Code: 789012Google Authenticator vs SMS OTP
Google Authenticator
SMS OTP
Google Authenticator (TOTP) works offline and can't be intercepted
SMS OTP requires cellular service and is vulnerable to SIM swapping
TOTP codes are generated locally on device
SMS codes are sent over cellular network (can be intercepted)
TOTP is more secure (phishing-resistant, not interceptable)
SMS is more convenient (familiar to users)
Best Practices for Google Authenticator
- Backup codes: Always provide backup codes during TOTP setup - users who lose their phone will be locked out
- Multiple devices: Encourage users to set up TOTP on multiple devices (phone + tablet) for redundancy
- Secret key backup: Display the secret key (not just QR) during setup so users can manually enter it if needed
How LoginRadius Powers Google Authenticator
LoginRadius CIAM platform provides seamless TOTP integration supporting Google Authenticator, Authy, Microsoft Authenticator, and all RFC 6238-compatible apps. Our APIs generate QR codes and secret keys for easy enrollment, provide backup codes for account recovery, and support TOTP verification during login flows. LoginRadius also offers administrative tools to manage user MFA settings, force TOTP enrollment for specific user groups, and provides fallback authentication methods (SMS, email) for users who lose their TOTP device.
FAQs
If you lose your phone: (1) Use backup codes - most services provide one-time backup codes during TOTP setup, (2) Contact support - they can verify your identity and disable TOTP, (3) Use alternative 2FA - if you set up multiple 2FA methods (SMS, email), use those to regain access. This is why it's critical to save backup codes in a safe place (password manager, printed copy) during TOTP setup.
No, there are many TOTP apps: Authy (cloud backup, multi-device), Microsoft Authenticator (push notifications, cloud backup), 1Password (TOTP built into password manager), LastPass Authenticator, and FreeOTP (open source). All these apps use the same TOTP standard (RFC 6238), so any TOTP-compatible service works with any TOTP app. Google Authenticator is just the most well-known.
LoginRadius supports TOTP-based MFA including Google Authenticator, Authy, and other TOTP apps. Our platform provides: (1) QR code generation for easy TOTP setup, (2) Secret key display for manual entry, (3) Backup codes generation during enrollment, (4) TOTP verification API for login flows, and (5) Fallback options (SMS, email) if TOTP device is unavailable. LoginRadius also supports push notification MFA as an alternative to TOTP.