Google Authenticator Syncs Codes Across Devices, but Security Experts Warn of Risks
In July 2026, Google released an update to its Authenticator app that allows users to sync their Time-based One-Time Password (TOTP) codes across devices using their Google Account. This change was met with both enthusiasm and concern from security experts, who pointed out that the stored secrets were not end-to-end encrypted.
The update is a significant improvement over the previous model, which required users to manually re-register every service in case they lost their phone. However, it also raises questions about account security, as syncing codes now live in the user's Google Account, which can be compromised if hacked.
To mitigate this risk, experts recommend enabling cloud sync while hardening the Google Account and building an offline backup system. This involves adding a passkey or security key to the Google Account, removing SMS recovery options, generating 10 backup codes, and verifying sync across devices.