Why a password is not enough
A strong password can still be stolen. A fake login page can capture it, and a breach can expose a password you reused elsewhere. Attackers can then try that password on other accounts. Two-factor authentication puts another check between a stolen password and your account. The UK’s National Cyber Security Centre recommends enabling two-step verification on important accounts, even when they have strong passwords.
Start with your primary email: it often receives password-reset links for everything else. Then protect financial accounts, work tools, cloud storage, and social accounts. An account takeover can expose private documents, interrupt your work, or let someone contact friends and customers in your name.
How two-factor authentication codes work
Two-factor authentication combines two different kinds of proof. With a password and an authenticator code, these are something you know—your password—and something you have—access to the authenticator holding your account’s secret. Multi-factor authentication (MFA) is the broader term for using more than one factor.
A time-based one-time password, or TOTP, is a short-lived code calculated from a secret setup key and the current time. When you enable authenticator-based 2FA, the service gives you that key, usually inside a QR code. Sign In uses it to generate codes locally; the service uses its copy to check them. Codes commonly change every 30 seconds, as described in the TOTP specification, RFC 6238.
The setup key matters more than any single code: someone who copies it can generate future codes. Keep setup keys and QR codes private. Do not send them in support messages, share screenshots of them, or paste them into a chat.
Why choose Sign In for your 2FA codes?
For everyday iPhone users, we believe the most secure approach to storing authenticator secrets starts with keeping them under your control. We built Sign In, our authenticator app, around that principle: local code generation, no authentication secrets on our servers, and secure sync only when you choose it.
- Your codes are generated on your device. Once an account is set up, Sign In can generate its codes without an internet connection.
- We do not hold your authentication data. Your setup keys, account labels, and generated codes are not sent to or stored on Sign In’s servers. There is no server-held collection of your authentication secrets for an attacker to steal from us.
- No Sign In account is required. You can use the app without creating another login.
- Backup is your choice. Keep your authenticator accounts on your devices, or enable syncing through your personal iCloud Keychain.
This is a specific security advantage: fewer places hold your authentication secrets. Your device security and the security of the services you use still matter. Each service retains the information it needs to verify its own codes. Our Privacy Policy explains Sign In’s storage and data handling, including optional service-logo requests.
Optional secure sync with Apple’s iCloud Keychain
If you want your authenticator accounts available on more than one device, enable Sign In’s optional account backup. It uses your personal iCloud Keychain, Apple’s secure keychain syncing system, to keep them in sync across your iOS devices signed into the same Apple Account. Sign In does not upload a copy to our own servers.
Apple documents that Passwords and Keychain data is end-to-end encrypted, including under standard iCloud data protection. You do not need Advanced Data Protection for that Keychain protection. Apple also states that it cannot read your iCloud Keychain.
Sync transfers the protected account secrets needed to generate codes; each device calculates its own current codes. That gives you the convenience of using multiple devices without handing your secrets to Sign In’s servers.
| Location | What happens there |
|---|---|
| Your devices | Your authenticator accounts are stored here, and codes are generated locally. |
| Your iCloud Keychain | When you enable account backup, your authenticator accounts sync using Apple’s end-to-end encryption. |
| Sign In’s servers | We do not store your authentication secrets, account labels, or generated codes. |
You can turn account backup off at any time. Turning it off does not necessarily delete an existing synced copy; manage stored copies separately through the applicable app and iCloud settings. Sync availability and recovery depend on Apple’s services and your account settings.
Authenticator codes, passkeys, or SMS?
Choose a method your service supports and understand what it protects:
- Authenticator codes: Sign In is our recommended choice when a service supports TOTP. Codes work offline and do not depend on text delivery or control of your phone number.
- Passkeys and FIDO security keys: These provide phishing-resistant sign-in by binding authentication to the real service. Use them where supported, especially for sensitive accounts. The FIDO Alliance explains how passkeys work.
- SMS or text messages: A useful extra step when stronger options are unavailable, but phone-number takeovers and message interception create risks that locally generated codes avoid.
Code-based 2FA can still be phished: a fake website may ask for your password and your current code, then use both immediately. NIST’s authentication guidance distinguishes one-time codes from phishing-resistant methods and describes phone-network risks. Enter codes only on the genuine service you intended to sign into, and never read one to an unexpected caller.
Protect your first account with Sign In
- Open the service’s security settings. Find its two-factor authentication or two-step verification settings and choose the authenticator-app option, if offered.
- Add its setup key to Sign In. For a QR code displayed on another screen, use Add → Scan QR Code. On the same phone, use the service’s manual key with Add → Enter Setup Key, then Add Account.
- Finish on the service’s website or app. Enter a current code from Sign In and confirm that 2FA is enabled. Adding an account to Sign In alone does not complete the service’s setup.
- Save the service’s recovery codes. Keep them somewhere secure that you can reach if your phone is unavailable.
For exact service-specific steps, start with our Google 2FA guide, Instagram 2FA guide, or browse all setup guides. If you need an authenticator for iPhone, get Sign In on the App Store.
Plan for a lost phone before you lose it
Optional iCloud Keychain sync can help you keep access across your devices, but it does not replace the recovery methods supplied by each service. Keep recovery codes separately from the account they unlock, and check that you can reach them without the missing phone.
Protect your devices with a strong passcode, keep their software updated, and keep your Apple Account recovery options current. Before wiping an old phone, verify that your accounts and codes work on the new one. Because Sign In does not hold your secrets, we cannot retrieve them or recover your personal iCloud backup for you.
Common questions about 2FA and Sign In
Do I still need 2FA with a strong, unique password?
Yes, when you sign in with a password and the service supports it. A unique password limits the damage from reuse, while 2FA adds a separate check if that password is stolen. Passkeys offer a different, phishing-resistant way to sign in where available.
Does Sign In store my 2FA codes?
Sign In generates codes locally from authentication secrets stored on your devices. We do not store those secrets, your account labels, or generated codes on our servers. If you enable account backup, your authenticator accounts also sync through your personal iCloud Keychain.
Can I use Sign In without iCloud sync?
Yes. Authenticator-account backup is optional. You can generate codes on your device without enabling it. Save the services’ recovery codes so you have another way in if that device is lost.
Do authentication codes work without internet access?
Yes. After setup, Sign In generates TOTP codes using the stored secret and your device’s clock. The website or service you are signing into generally still needs an internet connection. Keep your device’s date and time accurate.
Sources and further reading
This guide draws on NCSC guidance on two-step verification, RFC 6238 on TOTP, NIST’s authentication guidance, and the FIDO Alliance’s passkey overview. Apple describes its encryption in the iCloud data security overview and iCloud Keychain privacy notice. Sign In’s product-specific data practices are described in our Privacy Policy.