Two different kinds of proof: something you
know (your passphrase) and something you have (your phone).
Even if someone learns your password they still cannot
get in, because the six-digit code changes every 30 seconds and exists only on
your phone.
You need an authenticator app:
- Proton
Authenticator — Swiss, free, open source,
no account needed. Phone and desktop.
- Aegis
— Android, open source, keeps everything on
the phone and makes encrypted backups.
- Google Authenticator —
Android ·
iPhone
- Any other TOTP app works too: 2FAS, Ente Auth,
1Password, Bitwarden. They all follow the same standard.
The app never talks to us, so where its makers are based
matters less than whether it keeps your codes on your own device. Pick one that
backs up, and add it to two devices.
Scan the square code once. The app then generates codes
forever, even offline.
Lost the phone? Sign in with a recovery code instead —
whym then offers to set up a new authenticator straight away.