How to Set Up & Use Proton Authenticator

Open the app and you get a short welcome screen — tap Get started. It then offers to import codes from another authenticator.

If you are moving off Google Authenticator, Authy or similar, that import is the quickest way to bring everything across. If you are setting up two-factor for the first time, tap Skip — there is nothing to bring over yet. Either way you land on your vault, which starts empty.

Do this part on a computer if you can. Open the account you are protecting on a device other than your phone — your phone needs its camera free to scan the QR code the account puts on screen, so having that code on a second screen makes the whole thing far easier.

Two-factor is switched on from the account you want to protect, not from the authenticator app. Start with your email — whoever controls that can reset the password on everything else you own.

Taking Gmail as the example: go to myaccount.google.com, open Security, then 2-Step Verification, and choose Authenticator. Google shows you a QR code, exactly as in the example above. Leave it on screen — that is what your phone is about to read.

With that QR code still on screen, pick up your phone and open Proton Authenticator. Tap Create new code — the first time, iOS or Android will ask permission to use the camera, so tap Allow. Then point the camera at the code on your computer.

That is the whole handover. The QR contains a one-time secret shared between the account and your app — once it is scanned, the account appears in your vault and immediately starts generating 6-digit codes that change every 30 seconds.

Continuing with our Google example: back on the computer, the account asks for a code to prove the pairing worked. Read the 6-digit code next to the account in Proton Authenticator, type it in, and choose Verify. The account confirms the authenticator has been added, and it is protected from this point on.

Watch the little ring beside the code as you do it. Each code is only valid for about 30 seconds — if the ring runs out mid-typing, just use the fresh one that replaces it.

An authenticator app generates its codes entirely offline. That is its great strength — nothing to intercept, nothing to SIM-swap, and it works with no signal at all — but it is also its one real weakness. If you lose the phone, or the app, and you have no other copy of those codes, you can be locked out of every account it was protecting. There is no “email me a reset” for an authenticator.

The best answer is backup codes, which some providers call recovery codes: a set of one-time codes the account issues for exactly this situation. They are offline too, which is the point — they are a second offline route in, kept separately from the app. Continuing with our Google example, they live under Security → 2-Step Verification → Backup codes; choose Get backup codes and download or print the ten you are given. Each works once, in place of an authenticator code.

Store them somewhere you can reach without your phone — printed and put away, or in a password manager on another device. Saving them onto the same phone that holds your authenticator defeats the point entirely. Whenever an account offers them, take them.