Two-factor authentication means a stolen password is not enough on its own. An authenticator app is the practical way to do it: a six-digit code that changes every 30 seconds, generated on your phone, with no text message to intercept.
This guide covers which app to pick in New Zealand, how the codes work, and the part everyone gets wrong — moving them to a new phone.
Why an app beats a text message
Codes sent by SMS travel over the phone network, where they can be intercepted through SIM swapping: an attacker convinces a mobile provider to move your number to their SIM, then collects your codes. App-generated codes never leave your phone, so there is nothing to intercept.
SMS is still far better than nothing, and for a bank that offers no alternative you use what you are given. But where an app is an option, take it. New Zealand’s National Cyber Security Centre gives the same advice: turn on two-factor authentication for email, banking and social media, avoiding text-message codes where you can.
How the codes work
When you scan a setup QR code, the site shares a secret key with your app. The app combines that key with the current time to produce a code, and the site runs the same calculation to check it. That is why the codes expire, why your phone clock must be roughly accurate, and why the app works with no internet connection at all.
Which authenticator app to use
| App | Backup and sync | Worth knowing |
|---|---|---|
| Microsoft Authenticator | Cloud backup, restores to the same platform only | Password storage and autofill were removed during 2025; it now handles codes and work account sign-ins |
| Google Authenticator | Syncs to your Google account since 2023 | Simple and widely supported; transfer between phones by QR export |
| Bitwarden Authenticator | Standalone, or synced with a Bitwarden vault | Free and open source; suits people already using Bitwarden |
| 2FAS | Backs up to iCloud or Google Drive | Open source, with browser extensions |
| Aegis (Android only) | Encrypted local backups | Password-protected vault, imports from Google and Microsoft apps |
Authy, once the standard recommendation, discontinued its desktop apps in March 2024 and had roughly 33 million phone numbers exposed through an unsecured endpoint later that year. It still works, but there are better starting points now.
Should codes live in your password manager?
Most managers can store two-factor codes alongside the password. It is convenient, and far better than not using two-factor at all. The trade-off is that one compromised vault then gives up both factors, so for your most important accounts — email, banking, the password manager itself — keep the codes in a separate app. Our password manager guide covers which ones offer it, and the Bitwarden Authenticator guide goes deeper on that pairing.
Setting it up without locking yourself out
- Start with your email account. Everything else can be reset through it.
- Scan the QR code with your app of choice.
- Save the recovery codes the site gives you. Print them, or store them in your password manager under a different account than the one they unlock.
- Sign out and back in once to confirm the codes work before you rely on them.
- Repeat for banking, social media and any account holding payment details.
Moving to a new phone
This is where people get stranded. Codes do not move automatically unless your app syncs them.
Microsoft Authenticator restores from cloud backup, but only to the same operating system — iPhone to iPhone, Android to Android — and work or school accounts must be verified again. Google Authenticator syncs through your Google account, or transfers by exporting a QR code from the old phone. Bitwarden Authenticator and 2FAS restore from their own backups.
Whatever you use, do the transfer while you still have the old phone working. Recovering an account when both the password and the second factor are gone means proving your identity to each service individually, which can take weeks.
Where a site supports passkeys, they remove the code step entirely — our passkey guide explains how they work and which New Zealand services accept them.
Disclaimer
General information only. If you have lost access to an account, use the provider’s own recovery process; report suspected fraud to your bank and to the NCSC on 0800 114 115.
Reference sources
Frequently asked questions
Which authenticator app is best in New Zealand?
Any of the main ones work with New Zealand services, because they all use the same open standard. Pick on backup: Google Authenticator and Microsoft Authenticator sync to accounts you already have, while 2FAS, Aegis and Bitwarden Authenticator suit people who prefer open source.
Is an authenticator app safer than SMS codes?
Yes. App codes are generated on your device and cannot be intercepted by SIM swapping, which is the main attack against text-message codes.
What happens if I lose my phone?
You use the recovery codes the site gave you at setup, or restore from your app’s backup. Without either, each service has its own identity-verification process, which is slow.
Do authenticator apps need an internet connection?
No. Codes are calculated from a stored secret and the current time, so the app works in flight mode. Your phone’s clock does need to be roughly correct.
Can I use the same app for all my accounts?
Yes, one app holds as many accounts as you need. Consider keeping your most critical accounts in a separate app from your password manager so that one compromise does not hand over both factors.
Why did Microsoft Authenticator stop saving my passwords?
Microsoft removed password storage and autofill from the app during 2025. Saved passwords moved to the Microsoft account and Edge; the app still handles verification codes and work account sign-ins.
