Google Authenticator Security & Privacy Scorecard

Google Authenticator

What This Means for You

Your two-factor authentication codes are encrypted on your device and can optionally sync to your other devices through your Google account. The main privacy consideration is that enabling sync means your codes travel through Google's infrastructure to reach your other devices.

Recommendation: Very Secure

Excellent 2FA solution with industry-standard encryption and comprehensive security practices. Safely syncs your authentication codes across devices, keeping you protected no matter where you access your accounts.

Best For: Google ecosystem users who want seamless cross-device 2FA sync and trust Google's infrastructure security

Key Findings

Data Security - 0 findings

Network Security - 1 finding (1 info)

Code Safety - 3 findings (2 low, 1 info)

Privacy - 3 findings (1 low, 2 info)

Privacy Concerns

What Data is Collected

• Authentication codes: Generated and stay on your device. The underlying account secrets may be transmitted to Google's infrastructure if you choose to enable cross-device sync.

• Account names and issuers: Stored on your device; these sync to Google's servers if you enable the account sync feature.

• Deidentified app performance data: Memory, battery, and crash metrics are sent to Google. No authentication data is attached to these reports.

Third-Party Data Sharing

The following third parties may receive your data:

• Google - Deidentified app performance metrics (no authentication data included). If account sync is enabled, your authentication account data is transmitted through Google's infrastructure for cross-device access.

Understanding the Scores

Security: 97/100
Privacy: 95/100

Security Breakdown

• Data Security: 100/100 - Outstanding protection. Authentication codes are secured with strong encryption tied to your device's hardware security chip and remain inaccessible to other apps.

• Network Security: 99/100 - All connections are encrypted. The app enforces secure connections globally and blocks unencrypted traffic throughout.

• Code Safety: 98/100 - Excellent code security posture with no dangerous permissions, no advertising or tracking SDKs, and multiple protective measures in place.

Privacy Breakdown

• Data Collection: 25/100 - When Google account sync is enabled, your authentication account names, issuers, and underlying secrets may be transmitted to Google's infrastructure. Deidentified app performance metrics are also sent to Google regardless of sync settings.

• Data Sharing: 96/100 - No advertising, tracking, or third-party marketing SDKs receive your data. Data flows are limited to Google's own infrastructure.

• User Control: 97/100 - You decide whether to enable account sync, and the developer provides options to request deletion of your data.

Positive Security Features

• Authentication codes are secured with strong encryption tied to your device's hardware security chip, making them extremely difficult to extract even if your device falls into the wrong hands.

• The app blocks screenshots and screen recordings globally across every screen, protecting your codes from screen-capture malware.

• Your authentication database is excluded from Android's automatic backup system, preventing it from being copied to cloud storage without your explicit action.

• Your authentication database is stored in secure storage that is inaccessible before your device is first unlocked after a reboot.

• All network connections are encrypted throughout the app. Unencrypted connections are globally blocked.

• Camera access is used only for QR code scanning directly on your device. No images are transmitted anywhere.

• No advertising, attribution, or tracking SDKs from third-party marketing companies are included.

• The account transfer process cannot be triggered by other apps on your device.

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Cross-Device Sync Transparency
   Clearer in-app disclosure about whether authentication secrets transmitted during Google account sync are protected end-to-end between your devices, or accessible to Google's infrastructure, would help you make a fully informed choice before enabling sync.

2. Performance Telemetry Opt-Out
   Providing an in-app option to opt out of sending deidentified performance metrics to Google would give privacy-focused users greater control over what leaves their device.

Security Enhancements

1. QR Code Link Verification
   Verifying the identity of the app or website initiating an account enrollment via the otpauth:// link format would reduce the risk of a deceptive enrollment dialog being presented by a malicious app.

2. Legacy Encryption Migration
   Accounts migrated from very old device installations may still hold data protected by an older encryption scheme. Adding a one-time migration step to bring any such legacy data up to the current encryption standard would eliminate this residual concern.

Technical Context

App Type: Two-factor authentication, high-sensitivity credentials
Classes Analyzed: 8,457
Third-Party Services: 13
Context Tags: sensitive_data, security

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Google LLC
Version: 7.1 (versionCode 7001056)
Analysis Date: 2026-06-26
Package: com.google.android.apps.authenticator2

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 7.1 analyzed on 2026-06-26
• May not reflect server-side security controls
• Cannot detect all runtime behaviors