Choosing an authenticator app: the options compared
Several free apps generate the same six-digit codes. They differ in backups, device moves and extra security.
In this guide
Every BuyVCC account is protected by a six-digit code from an authenticator app, and many of the services you pay with your cards offer the same protection. All standard authenticator apps produce the same kind of code using the same open method, so any of them will work with any site that shows a setup QR code. Where they differ is in what happens when something goes wrong: a lost phone, a new phone, a broken screen. Choosing an app is really choosing how you will recover your codes on a bad day.
How the codes work, briefly
When you scan a setup QR code, the app stores a secret shared with the site. Every thirty seconds, the app combines that secret with the current time to produce a code. The site does the same calculation and checks that your code matches. No internet connection is needed to generate codes, and no text message is involved. That is why app codes are safer than text-message codes; SIM swaps and text codes explains the difference.
The secret lives on your phone. If the phone is lost and the secret was never backed up anywhere, the codes are gone with it. Everything else in this guide follows from that fact.
The main kinds of authenticator apps
Simple apps with no backup
Some apps store secrets only on the device and offer no backup at all, or only a manual export. They are simple and keep secrets off any server, but a lost phone means recovering every account one by one through recovery codes or support.
Apps with encrypted backup
Many popular apps can now back up secrets, either to the app maker's cloud linked to an account, or to an encrypted file you store yourself. Several widely used free apps from large tech companies and from independent developers offer this. Backups make moving to a new phone easy. The trade-off is that the backup itself must be protected: a strong, unique password for the backup or the account behind it, ideally with its own second factor.
Password managers with built-in codes
Some password managers can store authenticator secrets alongside passwords and fill codes automatically. Convenient, and fully synced across devices. The trade-off: password and code live in the same place, so anyone who unlocks the manager has both factors. Many people accept that for everyday accounts but keep codes for money-related accounts in a separate app.
Open-source apps
Open-source authenticators publish their code for anyone to review. Some keep everything local and offer encrypted export files. They suit people who want full control and are comfortable managing their own backups.
What to look for
| Feature | Why it matters |
|---|---|
| Backup or export | Lets you recover codes after losing a phone |
| Encrypted backup | Keeps secrets safe if the backup is exposed |
| Transfer to a new phone | Makes switching devices painless |
| App lock (PIN or fingerprint) | Stops someone holding your unlocked phone from reading codes |
| Works offline | Codes work without signal, useful while traveling |
| Hidden codes until tapped | Prevents shoulder-surfing |
| Clear account names | Easier to pick the right code quickly |
A sensible setup for most people
- Choose a well-known authenticator app with encrypted backup and an app lock.
- Protect the backup with a strong password you do not use anywhere else.
- Turn on the app lock.
- Add your BuyVCC account and your other money-related accounts.
- Save each site's recovery codes somewhere safe and separate from your phone, such as a printed sheet at home or an encrypted note.
- Test the backup once by checking that the app shows it as complete.
The account setup flow on our site walks you through scanning the code and saving recovery codes. Sign-up to first order in ten minutes shows each screen.
Recovery codes are your second safety net
Each recovery code works once in place of an authenticator code. If your phone is lost and you have no backup, a recovery code gets you back into your account so you can set up the authenticator again. Store them as carefully as a spare house key. If you lose both the phone and the recovery codes, sign-in requires a support ticket and identity checks for a reset, which takes time by design.
Things to avoid
- Screenshots of setup QR codes. Anyone with the image can generate your codes. Delete them.
- Storing recovery codes in the same app or phone as the authenticator. If the phone goes, both go.
- Reading codes aloud or sending them to anyone. No genuine support team asks for your current code. Screen sharing risks covers this common trick.
- Uninstalling the app before moving codes to a new phone. Moving your authenticator to a new phone lists the safe order.
Why codes matter for card details
On BuyVCC, a card number stays masked until you type a new code from your app, and sixty seconds later it is masked again. That means even someone who knows your password cannot see your card details without your phone. The authenticator is the lock on your cards; choosing it carefully is worth a few minutes.
Quick answers
Can I use two authenticator apps for the same account?
Yes, if you scan the same setup code into both at the same time. Both will then show matching codes. Keep that setup code private and delete it afterwards.
Does the app need internet access?
No, codes are generated offline. Backups and transfers need a connection.
See how it works and pricing for ordering cards.
BuyVCC Team
The people who review BuyVCC orders write these guides from the questions customers send us. Notice something outdated? Let us know.