Google Authenticator

Overview

Google Authenticator is a free mobile app that generates time-based one-time passcodes (TOTP). It launched in 2010 and is one of the most widely used second-factor apps in the world, supported by nearly every site and service that offers MFA. It is not an identity platform or an enterprise product. It is a single-purpose code generator that stores the shared secrets for your accounts and shows a rotating six-digit code.

What it is good at

It is free, simple, and universally supported. Setup is a quick QR-code scan, and the app now backs codes up to your Google account so you do not lose them when you replace a phone. For protecting personal accounts, a TOTP app is a large step up from SMS codes and from passwords alone, and Google Authenticator does that job cleanly with no cost and no account friction.

Where it falls short

TOTP is a shared-secret scheme, which means the code can be phished. An attacker who runs a convincing fake login page can capture the six digits in real time and replay them, so this is not phishing-resistant MFA. There is no admin console, no provisioning, no policy engine, no reporting, and no centralized recovery. It cannot enforce anything across a workforce. It is a consumer tool, full stop.

Pricing

Free. There is no paid tier and no enterprise edition, because it is not an enterprise product.

Best for, and who should look elsewhere

Choose it for personal accounts and for the smallest teams that just need a free second factor. Organizations that need policy, lifecycle, reporting, or phishing resistance should look at a real platform: Microsoft Authenticator if you live in Entra ID, Duo for managed workforce MFA, or Yubico and other FIDO2/passkey options for phishing resistance. See the full MFA directory and the how-to-choose guide, and model workforce cost with the TCO calculator.

Bottom line

A free, universal TOTP app that is great for personal use and useless as an enterprise control. Treat it as self-defense, not as a security program.