Google Authenticator: what it is, how it works, and why a YubiKey is more secure
Google Authenticator is a free app that generates a six-digit numerical code every 30 seconds. That code, together with your password, forms your second authentication factor.
It's a system known as TOTP (Time-based One-Time Password): a temporary code generated from a secret shared between the app and the service. It works without internet connection and is much better than having no 2FA. But it has a weak point against real-time phishing attacks.
How Google Authenticator works
You scan a QR code that shares a unique secret between the service and your mobile.
The calculation uses the shared secret and the current time, with no need for a connection.
Together with your password, this code confirms it's you.
⚠️ The weak point: real-time phishing
If you enter your code on a fake website, the attacker can copy it and use it on the real website before it expires. The code is valid, but you didn't know you were on the wrong site. Against this, FIDO2 and WebAuthn —the protocols used by a YubiKey— verify the real domain before responding, and they don't work on a fake website.
Google Authenticator vs YubiKey
- Free and easy to install
- Vulnerable to real-time phishing
- Depends on having your mobile with you
- If you lose your mobile without a backup, you lose access
- Resists phishing — verifies the real domain
- Doesn't depend on battery or connection
- Works via NFC or USB in seconds
- One-time cost, no expiration
This doesn't mean Google Authenticator is useless. For low-risk accounts it's still an improvement over having no 2FA. But on sensitive accounts —banking, main email, cryptocurrency exchanges— the difference matters.
Always carry it with you
A YubiKey only protects you if you have it with you. The credit card format means it fits in any wallet without you noticing the bulk. NFC works without taking it out of the case.
Credit card format tray for YubiKey
Thickness equivalent to 3 cards. NFC works without taking the key out. Made in Spain (EU).
Keychain case with metal ring
To carry it on your keychain, protected from bumps and scratches. PLA+ made in Spain (EU).
Frequently asked questions
Can I use Google Authenticator and YubiKey at the same time?
Yes. Many services allow you to register multiple 2FA methods. You can use the YubiKey as primary and Authenticator as backup, or vice versa.
What happens if I lose my mobile with the app installed?
Without backup codes saved, you can be locked out of your accounts. This is one of the reasons why many people prefer a physical second factor like the YubiKey.
Does the YubiKey work without battery or connection?
Yes. It's powered by the USB port itself or by the NFC field from your mobile when you bring it close, with no battery of its own or need for internet.
Verdict
Google Authenticator isn't bad — it just has a clear limit
For low-risk accounts, the app is sufficient and free. For the accounts you really care about, a YubiKey adds a layer that real-time phishing can't bypass.
YOU MIGHT BE INTERESTED
Which YubiKey to buy according to your device? Complete guide 2026
As an Amazon Associate, I earn from qualifying purchases.
