I have a Google account with one of the organisations I volunteer for. They have recently taken the decision to require 2FA for all account sign-ins. Google's 2FA enrolment process requires one of (a) PSTN phone number, (b) Google app on smartphone (NOT Google Authenticator), (c) hardware security token. I'm not prepared to give Google my phone number, nor am I willing to install a Google app that requires me to be signed in on a phone when there are numerous third party OTP implementations available (apart from anything else I very rarely use a smartphone and would prefer to use a desktop app). The organisation is not providing a hardware token and I don't have one of my own. Is there another alternative? For example, getting the settings and initialisation key to use with an OTP app, or a browser extension that acts in the same way as a hardware token. I'm running Ubuntu 21.04 and Firefox, but could use a Chrome-based browser if absolutely necessary.

(Edited to clarify that Google Authenticator is NOT offered as an option during enrolment: only the Google (Search) app or the Gmail app are possible.)

  • 1
    2FA for a Google account doesn't require (b) Google-specific app on smartphone, it requires any OTP Authenticator, with Authy being one of the best due to cloud-backup for restoring all to a new device, smartphone/PC support, and encryption ability. (a) personal phone number is for using the smartphone itself as a hardware key via the Google app, with (c) hardware security token being the most secure option, and even if a hardware key is used, such as a YubiKey, a secure OTP app should still be registered as a backup.
    – JW0914
    Commented Jun 24, 2021 at 13:17
  • 2
    Unfortunately this isn't true during the initial enrolment process, or at least it wasn't for my account. Not sure if this is due to a change in Google's policies, or if it's a configuration option set by the organisation admins. Either way, it requires the Google app, not Google Authenticator. However, once 2FA has been set up, it's possible to add OTP-based 2FA and remove the original 2FA method.
    – Kitserve
    Commented Jun 28, 2021 at 4:55
  • You weren't able to configure it with an OTP app during the initial 2FA setup?
    – JW0914
    Commented Jun 28, 2021 at 12:57
  • 1
    That's correct. The option wasn't offered during enrolment, which was why I got so confused.
    – Kitserve
    Commented Jun 30, 2021 at 2:56

3 Answers 3


There are two choices for "Google specific app on smartphone" – one uses online notifications (Google Prompt), the other uses offline OTP (Google Authenticator).


Google supports OTP-based 2FA under the name of "Authenticator app". It uses the OATH TOTP standard – exactly the same as what most other OTP apps use, with standard parameters (6 digits, 30 second interval).

As part of enrollment process, you'll be shown a QR code which directly contains the TOTP shared secret. You can scan it with just about any OTP app that exists (desktop apps should be able to "scan" a screenshot as well).

During the same step, you can also click the "Can't scan it?" and reveal the same TOTP seed as plain text. You can copy & paste it into your desktop OTP app, and perhaps write it down on paper to store as a backup.

The app will not need to communicate with Google. However, the device's clock needs to be accurate (the official Google app automatically compensates for wrong clocks using an online time server, but in other apps you'll need to take care of it yourself).

enter image description here enter image description here

It does not matter whether you choose "iOS" or "Android" when asked for your phone type – you'll get the same process either way.

(In case the "Can't scan it?" option goes missing, the QR code can also be scanned using a generic QR decoder, which will reveal the TOTP seed in plain text. The QR code's contents use the format otpauth://totp/GitHub:someuser?secret=ABCDEF&issuer=GitHub, with the username and issuer being for display only.)


Regarding hardware tokens – yes, there are browser extensions which emulate a WebAuthn or U2F token, but many of them seem to be abandoned and they might not necessarily be secure. (There's also the risk of them suddenly no longer working, so if you use one, make sure to have TOTP as a backup.)

On Linux you also have software such as rust-u2f which emulates a hardware U2F token at OS level – it will work with any website and any web browser because it's seen as an actual connected HID device. Still, it is somewhat more fragile than a real hardware token, and I'm not sure if I would go as far as to recommend using it.

Finally, letting the OS provide a software-based "platform token" is actually part of the newer WebAuthn specification. Windows 10 implements it under the "Windows Hello" name (supported by all major browsers), and Apple just added a similar "iCloud Passkey" feature in macOS Monterey.

Unfortunately, Google does not support 'platform' tokens, only hardware tokens – I'm not sure whether it's deliberate or if it's because they use the older U2F API rather than WebAuthn. (However, rust-u2f will still work because it emulates a hardware token, not a platform token.)

  • Thanks for the comprehensive answer, I'll look into your suggestions and report back. I am more than a bit confused by the language of the 2FA setup process, which just says "Get a Google prompt on your phone and just tap Yes to sign in". The wording makes it sound like they only support OTP codes via SMS or hardware device. Good to know that there are software implementations of hardware tokens, I did a search before posting but didn't manage to turn up any results.
    – Kitserve
    Commented Jun 24, 2021 at 9:14
  • 2
    For TOTP you want to be looking specifically for the "Authenticator app" option, which should look fairly generic (e.g. it doesn't say "Add phone", just "Set up"). If you're looking at a list that shows your specific phone -- that's the wrong place. (I'm not sure about the initial enrollment process, but the main "two-factor management" page has quite a few options - hardware key, TOTP "Authenticator", smartphone acting as hardware key via Bluetooth, "Google Prompt", SMS, phone call...) Commented Jun 24, 2021 at 9:24
  • 2
    @Kitserve "Get a Google prompt on your phone and just tap Yes to sign in" refers to (a) in your question, which uses the smartphone itself as a hardware key via the Google app (the actual Google app (Android || Apple), not the Authenticator app).
    – JW0914
    Commented Jun 24, 2021 at 13:28
  • 1
    Google prefers the authenticator mode with the app and push and phone authentication now adays, so you need to specifically seek out the older „Authenticator App“ mode (they seem to keep switching the names around and it also depends if this is google proper or the business/4domains setup).
    – eckes
    Commented Jun 25, 2021 at 0:55
  • 3
    Sorry it took a while to get back about this. With everyone's help I was able to get this working. Google didn't offer the option of OTP passwords to start with, just the Google app. Not sure if this is due to settings the admins set in Google Workspace, or if it's just the Google default nowadays. Thanks to user1686 I was able to enrol 2FA using rust-u2f. After enrolling it offered the option of setting up Google Authenticator, and I was able to use the settings in a desktop OTP app. Once that was set up I was able to remove the rust-u2f key.
    – Kitserve
    Commented Jun 28, 2021 at 3:45

As of 2022, it's not possible to do this upon initial enrollment, because setting up Google Authenticator as a 2FA option in Google requires that 2FA already be enabled ("To use Google Authenticator on your iPhone, iPod Touch, or iPad, you need: 2-Step Verification turned on"). This means you need to give them your phone number or otherwise setup 2FA using one of their apps on your phone. Then you can move to Authenticator.

Here is a workaround:

  • Create a virtual hardware security key using Chrome DevTools by following this guide (make sure to select type "u2f")
  • Initiate the Google 2FA setup using a Security Key while you have DevTools open with the virtual device active.
  • Having done that, you've met the prerequisite for having 2FA setup on your account, so you can now continue to setup your third party OTP app. You will now have the option available to setup 2FA with Authenticator App, which will render a QR code for you that you can use with any app that supports scanning a QR code to generate OTP codes (such as 1Password)
  • Wow, that was quick! I actually solved the problem with a workaround. I edited my answer to include it.
    – Miles R
    Commented Dec 24, 2022 at 1:01
  • And I have upvoted it :-) Commented Dec 24, 2022 at 1:02
  • I am org admin and I had 2 FA enforced with setting "Any except verification codes via text, phone call". During initial enrollment, auth app wasn't an option, so users who choose to enroll phone numbers got locked out from their accounts. I had to generate backup codes for them
    – Talha5389
    Commented May 12, 2023 at 16:06
  • Thanks, it helped me understand, that I will be able to add the authenticator app after enabling 2FA in any possible way. It simply shows no info about that.
    – o_nix
    Commented Aug 16, 2023 at 20:33

You don't need Google Authenticator specifically - any TOTP app will do. I've migrated from Google Authenticator to andOTP on my smartphone and it works fine.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .