Google Authenticator is a mobile security application based on two-factor authentication (2FA) that helps to verify user identities before granting them access to websites and services. Two-factor authentication makes it less likely that an intruder can masquerade as an authorized user. Authentication factors are categories of credentials used to verify that someone or something is who or what they are declared to be. There are three categories: Knowledge factors are credentials that the user knows, typically a user name and password; possession factors are things that the user has, typically a mobile phone; and inherence factors are things that the user is, typically a biometric characteristic such as a fingerprint or an iris pattern.

Authenticator works for any site or service that has enabled two-factor authentication. Like most web-based 2FA applications, the system combines knowledge and possession features. To access websites or web-based services, the user types in his normal username and password and then enters a one-time passcode (OTP) that was delivered to his device, triggered by the login. That combination verifies that the same person entering login data on the site is in possession of the device to which the Google Authenticator app was downloaded.