What is an authenticator app?
An authenticator app is a small utility that runs on your phone or computer and produces a time-based one-time password (TOTP) — a 6-digit code that rotates every 30 seconds. The code is calculated from a secret that you and the server share, so it works offline and can’t be predicted by anyone who doesn’t already have the secret.
When two-factor authentication is enabled on your PulsePass account, sign-in becomes two steps: you enter your email and password as usual, and then you enter the current code from your authenticator app. If either piece is wrong or missing, you’re not signed in.
Choosing an authenticator app
Any TOTP-compatible app works with PulsePass. The right one depends on how you want backups and device syncing to work. Here are the apps we recommend:
1Password
A password manager with built-in TOTP. Codes sync across every device signed in to your vault, and setup is a single tap from inside the 1Password app.
- Syncs across devices
- Encrypted cloud backup
- Paid subscription
Bitwarden
Free and open-source password manager. TOTP is built into paid tiers; the free tier pairs well with a dedicated authenticator app.
- Syncs across devices (paid)
- Open-source
- Self-hostable
Microsoft Authenticator
Free. Strong fit if you already use a Microsoft account, with optional encrypted cloud backup and push-notification approval for Microsoft sign-ins.
- Free
- Optional cloud backup
- iOS and Android
Google Authenticator
Free. The baseline choice — simple UI, and recent versions support cloud backup tied to your Google account.
- Free
- Cloud backup (optional)
- iOS and Android
Authy
Free. Codes sync across your phones, tablets, and desktop. Protect the account with a strong backup password — anyone with your Authy login can see your codes.
- Multi-device sync
- Desktop app
- Encrypted backups
Aegis & Raivo
Open-source, local-only authenticators. Aegis for Android, Raivo for iOS. Good pick if you prefer encrypted on-device backups over cloud sync.
- Open-source
- Local encrypted backups
- No account required
Pick one that backs up. If your phone is lost, stolen, or factory-reset, a backup is the difference between “restore and keep going” and “redo 2FA on every account you have.”
Setting up 2FA on PulsePass
- Sign in to your PulsePass account and open Security → Two-factor authentication.
- Choose Enable. PulsePass will show a QR code and a matching text key.
- In your authenticator app, add a new account and scan the QR code (or paste the key).
- Back in PulsePass, type the current 6-digit code from the app to confirm.
- PulsePass enables 2FA and shows you a batch of recovery codes. Save these somewhere safe.
From now on, every sign-in will ask for a 6-digit code after your password. On trusted computers you can check “Remember this machine” to skip the prompt for a while — PulsePass records the device so only that specific browser gets the benefit.
Recovery codes
Recovery codes are one-time-use codes you can use instead of a 6-digit code, in case you lose access to your authenticator app. PulsePass hands you a batch of ten when you first enable 2FA and shows them to you one time only.
- Save them in a password manager, print them, or write them down in a safe place.
- Each code works only once.
- You can generate a fresh batch at any time — doing so invalidates the previous batch.
- PulsePass warns you when you’re running low so you can regenerate before you’re locked out.
Don’t store recovery codes on the same device as your authenticator app. If you lose that device, you lose both your codes and your second factor at the same time.
Passkeys vs. authenticator codes
A passkey is already multi-factor on its own — it proves you have the device and that you unlocked it with biometrics or a PIN. So if you have a passkey registered, PulsePass will let you skip the authenticator-code step entirely on that device.
Running both is a good idea: passkeys give you a fast, passwordless sign-in on the devices you use every day, and an authenticator app is the reliable fallback when you’re on a borrowed computer or a device where passkeys aren’t available.
See also: Learn about passkeys.