Two-Factor Codes on a Windows PC: Authenticator Options That Are Safe

Google Authenticator has no official Windows app, so the only Google-made way to get its codes is still a phone. To get two-factor codes on a Windows PC, the safer choices are a reputable password manager that stores one-time codes, a passkey saved with Windows Hello, or a hardware security key. Avoid “Google Authenticator for PC” downloads and browser extensions that borrow the name, because Google does not publish them.

The codes themselves follow an open standard called TOTP (time-based one-time password). Any compliant app can generate the same 6-digit code from the same secret, which is why you have real options beyond Google’s own app.

Is there a Google Authenticator app for Windows?

No. Google Authenticator is available only for Android and iPhone. Listings in app stores or on download sites that use the name and logo for Windows come from other developers, and some are scams built to collect the secrets behind your codes. If you want to check what Google actually supports, the Google Account Help Center lists the official sign-in methods.

Google Authenticator can back up its codes to your Google Account, which helps when you replace a phone. That sync goes to another copy of the phone app, though, and does not put the codes on a PC.

What are the safest ways to get codes on a PC?

A password manager with built-in TOTP support is the most common answer. Several well-known managers have Windows apps and browser extensions that can store a code generator next to the saved password and fill it in at sign-in. Some charge for the feature, so check the plan before you rely on it.

Other sound options:

• An open-source desktop password vault such as KeePassXC, which runs on Windows and can generate TOTP codes from an encrypted file you control.
• Passkeys, which replace both the password and the code. On Windows they are unlocked with Windows Hello (PIN, fingerprint or face).
• A hardware security key that plugs into USB or taps over NFC. You touch it to approve the sign-in, and it only responds to the real website.
• Phone prompts, such as the “Is it you trying to sign in?” message Google sends to a signed-in Android phone or iPhone.

One trade-off applies to the first two choices. When the password and the code live in the same vault, someone who gets into that vault gets both. A strong master password and two-factor protection on the vault itself reduce that risk.

How do you move codes from your phone to a Windows app?

You usually cannot copy existing codes straight across, because most sites only show the setup QR code once. The reliable method is to add the PC app as a second authenticator for each account.

1. Sign in to the account on the website and open its security or two-step verification settings.
2. Choose to set up a new authenticator app. Many sites show a QR code and a “can’t scan it” link with a text key.
3. Copy the text key into your Windows password manager or desktop vault as a new one-time code entry.
4. Type the current code from the PC app into the website to confirm it works.
5. Keep the phone app working until you have signed in successfully with the PC app at least once.

Google Authenticator also has a “Transfer accounts” option that exports codes as QR codes, but it is designed to move them to another phone running the same app. Most desktop tools cannot read that export format directly.

Is it safe to keep two-factor codes on the same computer?

It is safer than no second factor, and less separated than a phone or a security key. Two-factor protection works best when the second step lives on a different device from your password. If malware takes over the PC, it may be able to read both.

A sensible split for most people looks like this:

• Email, banking and your main Google or Microsoft account: a passkey, a security key or a phone app.
• Lower-risk accounts such as forums and shopping sites: codes in a password manager are fine.

Keep Windows updated, too. A PC that no longer gets security patches is a poor place to store sign-in secrets, and the guide on what to do now that Windows 10 support has ended covers the upgrade choices.

Should you use passkeys or a security key instead of codes?

Yes, where a site offers them. One-time codes can be phished: a fake login page can ask for your password and your current code and use both within seconds. Passkeys and security keys are tied to the real website’s address, so a look-alike page cannot use them.

On Windows 10 and Windows 11, passkeys are stored in Windows Hello or in a password manager. You can also keep a passkey on your phone and sign in on the PC by scanning a QR code with the phone. The US Cybersecurity and Infrastructure Security Agency (CISA) recommends phishing-resistant multifactor authentication where it is available.

What should you do before you lose your phone?

Save backup codes for every important account today. Google, Microsoft and most large services let you print or download a set of one-time backup codes from the same security page where you set up two-step verification. Store them offline, for example on paper in a drawer, not in a note on the same PC.

Also add a second method to each account: a security key, a passkey or a second authenticator. With two methods registered, losing one device is an inconvenience and not a lockout. If you use an Android phone with your PC, the article on Google’s plans for Android photo backup to Windows covers another part of keeping the two in sync.

Quick answers

Can I use Google Authenticator in a Chrome extension?

Google does not make one. Extensions with similar names come from third parties, so treat them like any other password tool and check the developer before giving one your secrets.

Does Microsoft Authenticator work on Windows?

Microsoft Authenticator is a phone app for Android and iPhone. On a Windows PC, Microsoft accounts can use Windows Hello and passkeys instead.

Why does my PC code not match my phone code?

TOTP codes depend on the clock. If the PC’s time is off by more than about 30 seconds, codes fail. Turn on “Set time automatically” in Windows Settings under Time & language, then try again.

Is Authy still available on Windows?

Twilio discontinued the Authy desktop apps in 2024. Authy now runs only on phones, so desktop users need one of the options above.