Google Authenticator now syncs: turn it on?
Losing your phone no longer means losing your 2FA codes. But your Google account now holds them.
Google Authenticator finally backs up your codes to your Google account. Lose your phone, sign in on a new one, and your 2FA codes come back. Many people lost accounts over the years for lack of exactly this.
The catch: your codes now live with your Google account. Researchers also pointed out that the sync isn’t end-to-end encrypted yet, so Google could technically see them. Google says it plans to add that.
My take:
- For most people, turn it on. Losing codes is a much more common problem than Google’s servers being breached.
- Then protect the Google account like a vault: strong unique password, a passkey or security key, and recovery options you control.
- For admin and finance accounts, keep codes off the cloud, or better, use hardware security keys.
- Don’t keep the password and the code in the same place for your most important accounts.
Backups are good. Just know where your keys now live.