2-factor authentication is probably not a foreign word to you, you may also be actively using the technology. If not, here is a brief summary: 2-factor authentication (2FA) provides an extra layer of security to confirm your identity and prevent unauthorized access to online services or the like.

Typically, after entering a password, you will have to enter a 1-time password, which you will receive by SMS or special app, for example. This makes it necessary for a potential attacker to be in possession of the device (well, actually the key that generates the password), making unauthorized access to your account more difficult.

Today we’re talking about those apps that you can use to create such one-time passwords. One of the better known of these is certainly Google Authenticator. But I’d like to introduce you to an alternative. But to get a better idea of the whole thing, let’s take a quick look at how such apps work.

The Google Authenticator supports two different algorithms that are used to generate 1-time passwords. The first is the HMAC-based one time password algorithm (HOTP), where server and client each manage a secret value for password generation and a counter to ensure synchronization between the parties. In the Google Authenticator example, the secret value is the QR code scanned with a mobile phone. TOTP (Time-based one time password algorithm) is the second algorithm which is an extension to HOTP and replaces the counter with the current time.

This was of course only a minimal insight, but you can go into detail for example here (HOTP) or here (TOTP).

But now to the actual topic: The Google Authenticator is a nice thing, if everything works as it should. But what do you do if your smartphone gets lost? Did you export the backup codes? Possibly, but probably not. Sometimes there are reset options on the different portals, but I wouldn’t necessarily rely on that. Especially not when it comes to Cryptocurrency Exchanges, Wallets or other financial services.

That’s why I’ve been looking for alternatives that don’t rely on my mobile phone as a central point of contact and found the app Authy. Authy also generates one-time passwords like the Google Authenticator, but offers additional multi-client support, so you can use the app on your smartphone and PC. In addition, encrypted backups are possible if you are only using your smartphone. I recommend that you take a look at the app yourself and try it out yourself.

But how do you make the transition from Google Authenticator to Authy? That’s probably the only point that needs some effort. A migration from Google Authenticator to Authy is not possible, so you have to access the services you use with 2FA, deactivate the login via Google and then activate it with Authy. That’s it with configuration and you are ready to start!