How to use an authenticator without a phone

First, check what your service supports

Open the service’s security settings and look for “Authenticator app,” “Time-based codes” or “TOTP.” A QR code or setup key usually appears during enrollment. This is different from SMS codes, push approval prompts and passkeys.

iAuthIQ currently supports SHA-1, six-digit codes with a 30-second period. If a service requires another format or a specific app’s push approvals, use a compatible method instead.

Set up a browser authenticator

1. Keep your current sign-in method. Do not delete an existing authenticator while testing a replacement. Save the service’s recovery codes separately.
2. Create an iAuthIQ account. Use a unique password and a device you control. Read the security limitations first.
3. Choose Add account. If the QR code is on another screen, use the camera scanner. If it is on the same device, upload a tightly cropped screenshot or copy the service’s setup key.
4. Check the account details. Use a label such as “Google: you@example.com” so personal and work accounts are easy to distinguish.
5. Save and verify. Copy the new code from your vault and enter it on the service’s enrollment screen. Finish that service’s confirmation step before closing it.
6. Test your recovery method. Follow the service’s instructions to confirm another way to sign in remains available.

What if you already lost your phone?

A browser authenticator cannot recreate your old codes from your email address or password alone. You need the original setup key, a compatible backup, an existing signed-in device or the service’s recovery process.

Use the service’s recovery codes or official account recovery instructions. Never send a setup key or recovery code to someone offering to “recover” it for you.

Understand the trade-offs

Browser access is convenient, but the storage architecture matters. iAuthIQ currently stores setup keys on its server without application-level encryption and generates codes there. It requires internet access and is not a zero-knowledge vault. A locally stored authenticator or hardware security key may better fit your security needs.

Using passwords and codes on the same device also means a compromised device may expose both. Keep the operating system and browser updated, review extensions and avoid shared computers.

Can I use an iPad?

You can open the vault in a modern tablet browser. Camera access requires browser permission; uploading a QR screenshot or entering the setup key avoids the camera. Adding a home-screen shortcut does not enable offline code generation.

Having trouble with a code?

See TOTP code not working: what to check. Keep your existing access until the replacement works.