Best Authenticator App for iPhone 2026: Switch in 12 Steps

Google Authenticator still sits on more iPhones than any rival, pulling a 4.85 star average across more than 1.09 million US ratings, according to App Store Tracker’s 2026 ranking of two factor authentication apps. That popularity hides a real problem. Google Authenticator has no cross device encrypted backup built in, Authy quietly scaled back its desktop app, and plenty of people are still typing six digit codes from SMS messages that attackers can intercept with a simple SIM swap. If you are rethinking which app guards your email, bank, and work accounts, October 2026 is a reasonable moment to make the switch properly instead of downloading something new and hoping for the best.

The sections below cover through choosing the best authenticator app for iPhone in 2026, migrating your existing codes without locking yourself out of anything, layering in Apple’s passkey support, and building a local encrypted backup vault for your recovery codes. By the end you will have a working setup that survives a lost phone, a cracked screen, or a forgotten password, and you will understand exactly where passkeys fit alongside the time based codes most services still require. None of the steps below require any technical background beyond being comfortable in your iPhone’s Settings app, though Step 11 includes an optional project for anyone who wants a small, searchable, encrypted backup of their recovery codes rather than a sheet of paper in a drawer.

Google · Preferred Sources

Don't miss new tech stories on Google

Add TrendinTech once in the Google app and our stories appear in your news suggestions.

Add Now

Why Your Authenticator App Choice Matters More in 2026

Two factor authentication stopped being optional years ago, but the app generating your codes has quietly become a bigger security decision than most iPhone owners realize. Credential abuse remains the leading way attackers get into accounts in the first place, accounting for 22 percent of breaches according to Verizon’s 2025 Data Breach Investigations Report, cited in a 2026 roundup from Cybersecurity Canada’s 2026 report on Canadian SMB security statistics. A weak or unbacked authenticator app turns a stolen password into a full account takeover the moment your phone is lost, stolen, or simply replaced.

Microsoft’s own telemetry gives a clearer picture of what actually stops attacks. Phishing resistant multi factor authentication, meaning passkeys and FIDO2 security keys rather than plain six digit codes, blocks more than 99 percent of automated identity based attacks, based on data reported in a 2026 statistics roundup from VoxBooster’s two factor authentication statistics report. That is a meaningfully stronger result than code based apps alone deliver, which is exactly why this tutorial treats passkeys as a companion to your authenticator app rather than a replacement for every account, since plenty of services still have not added passkey support.

There is also a bypass problem specific to app based codes. Microsoft has attributed 80 percent of MFA bypass breaches to adversary in the middle session token theft, a technique that steals the authenticated session right after a user enters a valid code, according to 2026 reporting on social engineering statistics. A code generating app protects you from credential stuffing and basic phishing, but it does nothing to stop a convincing fake login page that relays your code in real time. Knowing that limitation changes how you should think about backup methods, recovery codes, and where passkeys belong in your setup, all of which the sections below cover step by step.

How TOTP Codes Actually Work Behind the Scenes

Every six digit code you type comes from the same math, no matter which app displays it. When you scan a QR code to set up 2FA, both your phone and the service agree on a shared secret key, a random string of letters and numbers that never travels anywhere again after that first exchange. From that point on, each side independently runs the current Unix timestamp, rounded down to the nearest 30 second window, through an HMAC-SHA1 hash alongside that shared secret, then truncates the result down to six digits. Because both sides are doing the identical calculation with the identical secret and the identical clock, the codes match without either device ever needing to talk to the other again.

That design has two consequences worth understanding before you migrate anything. First, the shared secret is the only thing that matters, which is exactly why exporting your accounts in Step 4 below is really just moving that secret from one app to another, not creating some new relationship with the service. Second, both devices have to agree closely on the current time, typically within a window of about 30 to 90 seconds depending on how strict the service is, which is why a phone with its clock set manually or drifting due to a stuck network connection will start generating codes the service rejects. Keeping automatic date and time turned on under Settings, General, Date and Time solves this for the overwhelming majority of people, and it is the first thing to check if codes suddenly stop working after a migration.

Prerequisites: What You Need Before You Start

Gather these before you touch any settings. Rushing this step is the single biggest reason people get locked out of accounts during a 2FA migration.

An iPhone running iOS 26 or later. Apple’s current passkey and passwords documentation is published against iOS 26, and earlier versions handle verification codes differently in Settings.
Your Apple ID signed in with iCloud Keychain and two factor authentication already turned on. Apple requires both before passkeys can be created or synced on the device.
A list of every account that currently uses your old authenticator app. Check your email inbox for “new sign in” and “2FA enabled” notifications going back at least two years if you are not sure.
15 to 20 minutes of uninterrupted time. Do not start this between meetings.
A second device, ideally an iPad, Mac, or a trusted family member’s phone, to test account recovery before you delete anything.
Python 3.10 or newer installed if you plan to build the local encrypted backup vault in Step 11 (check with python3 --version in Terminal on a Mac, or skip that step and use a paper backup instead).
A pen and paper, or a dedicated notes app with no cloud sync, for writing down one time recovery codes as you go.

Best Authenticator Apps for iPhone in 2026, Compared

Every authenticator app generates the same underlying time based one time password, called a TOTP code, so the differences that matter are backup, recovery, and what happens when you lose the phone. Here is how the main options compare heading into the back half of 2026.

App	Price	Encrypted Cloud Backup	Cross Platform	Passkey Support	Best For
Google Authenticator	Free	Google account sync only	iOS, Android	No	Simplicity, widest compatibility
Microsoft Authenticator	Free	Microsoft account sync	iOS, Android	Yes, for Microsoft accounts	Microsoft 365 households
2FAS Auth	Free, open source	Optional encrypted cloud backup	iOS, Android	No	Privacy minded users, no ads
Authy	Free	Cloud backup, scaled back desktop support	iOS, Android	No	Multi device sync fans
Duo Mobile	Free	Encrypted backup	iOS, Android	No	Push approval over typed codes
Ente Auth	Free, open source	End to end encrypted sync	iOS, Android, web	No	Open source transparency
2Stable Authenticator	Free tier, paid sync	Encrypted iCloud backup	iOS, watchOS	No	Apple Watch users
Apple Passwords	Built in, free	iCloud Keychain, end to end encrypted	iPhone, iPad, Mac	Yes, native	All in Apple ecosystem

Google Authenticator remains the default pick for sheer reach and familiarity, which is why App Store Tracker’s 2026 data still ranks it first by rating volume. Microsoft Authenticator is the obvious runner up if your work life runs through Microsoft 365. 2FAS Auth, Duo Mobile, and Ente Auth are the three worth a serious look if encrypted backup and no account lock in matter to you, since all three let you export your data and switch apps again later without friction. 2Stable is the niche pick for anyone who wants their codes on an Apple Watch face. None of this matters, though, if you migrate carelessly, so the rest of this tutorial assumes you have picked a target app and walks through the move itself.

It is also worth watching how fast this market keeps shifting. A year ago Authy was the default recommendation for anyone who wanted multi device sync, but its decision to pull back desktop support pushed a noticeable share of its user base toward 2FAS, Ente Auth, and Duo Mobile instead, all three of which kept investing in cross platform parity rather than narrowing their focus to mobile only. That kind of shift is exactly why this tutorial frames app choice as a decision you should revisit periodically rather than something you set once and forget, since the app that made sense two years ago is not necessarily the one that makes sense heading into 2027.

iCloud Keychain and Apple Passwords vs a Dedicated Authenticator App

Apple’s built in Passwords app, which draws on iCloud Keychain, can generate verification codes and store passkeys in the same place as your saved logins. That convenience is real, but it is not automatically the safer choice for every account. Apple’s own iPhone guidance confirms passkeys live in the Passwords app and sign in using Face ID, Touch ID, or your device passcode as a fallback, with public key credentials replacing reusable passwords entirely wherever a service supports them, according to Apple’s support guide on using passkeys to sign in to websites and apps on iPhone.

The tradeoff is ecosystem lock in. If you ever switch to Android, or you need to hand a code to a Windows laptop during a work login, a dedicated authenticator app travels with you in a way that Apple Passwords does not. The practical answer most security teams land on is to use both: passkeys through Apple Passwords for every service that supports them, since passkeys resist phishing in a way codes cannot, and a dedicated authenticator app for the larger list of services that still only offer TOTP codes. The table below breaks down why that layered approach beats picking just one method.

Method	Phishing Resistant	Works Without Internet	Survives a Lost Phone
SMS text codes	No	No, needs cell signal	Depends on carrier, risk of SIM swap
Email codes	No	No, needs internet	Only if email is itself secured with 2FA
TOTP authenticator app	No	Yes, codes generate offline	Only with encrypted backup enabled
Push notification approval	Partial	No, needs internet	Only with a registered backup device
Passkey (FIDO2)	Yes	Yes, on the enrolled device	Yes, if synced through iCloud Keychain

Step 1: Audit Every Account Tied to Your Current Authenticator App

Open your current app and write down, literally on paper or in an offline notes file, the full name of every account listed inside it. Most authenticator apps show a label and an issuer name, like “Amazon” or “GitHub ([email protected])”, but the label does not always match the actual service name exactly, so note the associated email address next to each entry too. This list is your source of truth for the rest of the migration. If you skip this step and something goes wrong during the transfer, you have no way to know which accounts still need fixing.

While you are in there, flag any account you no longer use. A closed bank account or an old freelance platform you have not logged into in three years does not need to make the trip to your new app. Fewer entries means a faster migration and a smaller attack surface if your new app is ever compromised. Most people find five to ten accounts they can simply delete from the old app without any further action.

Work accounts deserve their own line item on this list. If your employer uses single sign on through an identity provider, the authenticator entry you see might actually belong to that identity provider rather than to each individual app you log into, which means migrating one entry can cover a dozen work tools at once. Check with your IT or security team before touching anything work related, since some organizations manage enrollment centrally and expect you to request a new device registration rather than export an existing one yourself.

Step 2: Pick the Right Replacement App for Your Needs

Go back to the comparison table above and match it against your actual habits. If you live inside Microsoft 365 for work, Microsoft Authenticator removes friction you would otherwise fight every day. If you want a clean, ad free, open source option with no account required, 2FAS Auth or Ente Auth are the stronger picks. If an Apple Watch glance matters to you, 2Stable is worth the small subscription for cloud sync. There is no universally correct answer here, only a correct answer for your device mix and your tolerance for being tied to one company’s ecosystem.

Download the new app from the App Store now, but do not delete your old app yet. You will run both apps side by side until every account is confirmed working in the new one, which is the only safe way to do this kind of migration.

Step 3: Download and Prepare the New App

Open the new app and complete its first run setup. Most apps ask whether you want to create an account for cloud backup immediately. Say yes if the app offers encrypted backup, since you will want that enabled before you add a single code, not after. Set a strong, unique passphrase for the backup if one is requested, and store that passphrase in the same offline notes file from Step 1, never in the cloud note itself.

If the app supports Face ID or Touch ID to open the app itself, turn that on now too. An authenticator app that opens with a single tap and no biometric check is a soft target if someone else ever picks up your iPhone while the screen is already active.

Step 4: Export Your Existing TOTP Codes

How you export depends on your old app. Google Authenticator has a built in “Transfer accounts” feature under the three dot menu that generates a QR code for a batch of accounts at once. Authy and Duo Mobile require you to deregister the device from inside each account’s security settings instead, since neither supports a clean bulk export, which is one of their biggest drawbacks compared to 2FAS or Ente Auth.

If your old app has no export feature at all, you will need to redo the 2FA setup from scratch on each account’s website, generating a brand new QR code or secret key for the new app. That secret key always follows the same underlying format, regardless of which service issued it, which is worth understanding even if you never touch it directly:

otpauth://totp/ExampleService:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=ExampleService&algorithm=SHA1&digits=6&period=30

That string is what a QR code actually encodes. The secret parameter is the shared key both your phone and the service use to generate matching six digit codes every 30 seconds. If a service only gives you that raw string instead of a scannable QR code, most authenticator apps let you paste it in directly or enter the secret manually under “add account by typing a key”.

Step 5: Import the Codes Into Your New App

Scan the transfer QR code with your new app, or paste in secret keys manually for any accounts that required a fresh setup. Do this one account at a time rather than rushing through a long batch, checking off each entry against your Step 1 list as you go. A single missed account here is the most common reason people end up locked out later, so slow down even if it feels tedious.

Once an account appears in the new app and is generating a code that visibly counts down, move to the next one. Do not delete anything from the old app yet, that comes much later in Step 12.

Step 6: Verify Every Account Logs In Correctly

This is the step people skip, and it is the one that actually proves the migration worked. For every account you just imported, log out on the website or app, then log back in using the code from your new authenticator app. Do not just glance at the code and assume it matches, actually complete a real sign in for each one.

Keep a simple checklist as you go, marking each account with a confirmed successful login. If any account fails, do not panic. Most services still let you fall back on recovery codes generated when you first enabled 2FA, or a secondary method like email verification, which is exactly why Step 1’s account audit and Step 10’s recovery codes matter so much.

Pay attention to the exact failure message you get, since it usually tells you which of two problems you are dealing with. A message saying the code is simply wrong almost always traces back to the clock drift issue described earlier, fixed by toggling automatic date and time off and back on. A message saying the code has already been used, or that too many attempts have failed, usually means you are generating codes from two different sources for the same account, typically because you never finished removing it from the old app, which is worth double checking before you move on.

Step 7: Turn On Encrypted Cloud Backup

With every account confirmed, go into your new app’s settings and make sure encrypted cloud backup is active, not just offered. Some apps enable this by default during first run, others require you to flip a dedicated toggle after you have already added accounts. Check it explicitly rather than assuming.

Write your backup passphrase down somewhere offline if you have not already, and consider storing a second copy with a trusted family member or in a physical safe. A backup you cannot decrypt because you forgot the passphrase is functionally the same as having no backup at all.

Step 8: Layer In iCloud Keychain as a Fallback

Open the Passwords app on your iPhone, confirm iCloud Keychain and two factor authentication are both turned on under your Apple ID settings, and check whether any of your high value accounts, meaning banking, primary email, or your Apple ID itself, can also generate a verification code through Passwords as a second, independent method alongside your main authenticator app.

This is not about replacing your authenticator app. It is about giving yourself a second, Apple controlled recovery path that lives on a different system than your third party app, so a bug or outage in one does not strand you entirely.

Step 9: Add Passkeys Wherever a Service Supports Them

Go through your most important accounts again, this time checking each one’s security settings for a passkey option. When you find one, set it up. Apple’s iPhone passkey flow stores the credential in the Passwords app and signs you in with Face ID or Touch ID going forward, with your device passcode as the only fallback if biometrics are unavailable.

Passkey awareness has climbed fast. Ninety percent of consumers now say they are aware passkeys exist, and 75 percent have enabled them on at least some accounts, though only 49 percent use them whenever possible rather than defaulting back to a password, according to adoption data published in 2026 and summarized by About Chromebooks’ two factor authentication adoption statistics report. That same data puts authenticator app use at 55 percent of surveyed users in 2025, up only slightly from 54 percent in 2024, while passkey use reached 33 percent in its first full year of being tracked. The two methods are growing together, not replacing each other yet, which is exactly why this tutorial treats them as a pair rather than a choice.

Step 10: Generate Offline Recovery Codes

Most services that support 2FA also issue a set of one time recovery codes when you first enable it, usually eight to ten codes meant to be used once each if you ever lose access to your authenticator app entirely. If you never saved these the first time around, most account security pages let you regenerate a fresh batch now that your new app is confirmed working.

Write these codes down by hand, or type them into an offline file, for every account you consider important enough to have gone through this whole migration for. Do not store them in the same cloud note as your passwords. If that note is ever compromised, an attacker gets both your password and the exact codes meant to protect you from a password leak.

Step 11: Build a Local Encrypted Backup Vault

Paper works, but a small encrypted file on a Mac or external drive gives you a searchable backup of every recovery code without exposing them in plain text if the file is ever copied somewhere it shouldn’t be. This is a complete, working mini project you can build in about ten minutes using Python’s cryptography library, which handles the actual encryption so you are not rolling your own, which you should never do for anything security related.

First, install the library in Terminal:

pip3 install cryptography

Next, create a file called encrypt_backup.py with the following content. It generates a unique encryption key, saves it separately from the encrypted data, then locks your plain text recovery codes file:

from cryptography.fernet import Fernet
import os

KEY_FILE = "vault.key"
SOURCE_FILE = "recovery_codes.txt"
OUTPUT_FILE = "recovery_codes.vault"

if not os.path.exists(KEY_FILE):
    key = Fernet.generate_key()
    with open(KEY_FILE, "wb") as f:
        f.write(key)
    print("New encryption key created: " + KEY_FILE)
else:
    with open(KEY_FILE, "rb") as f:
        key = f.read()

fernet = Fernet(key)

with open(SOURCE_FILE, "rb") as f:
    plain_data = f.read()

encrypted_data = fernet.encrypt(plain_data)

with open(OUTPUT_FILE, "wb") as f:
    f.write(encrypted_data)

print("Encrypted " + SOURCE_FILE + " into " + OUTPUT_FILE)
print("Store vault.key somewhere separate from recovery_codes.vault")

Create a plain text file named recovery_codes.txt listing each account and its recovery codes, run the script, then move vault.key to a different physical location than recovery_codes.vault, ideally a USB drive kept in a drawer rather than anywhere near your laptop. Delete the original plain text file once the vault exists. To read the codes back later, create a matching decrypt_backup.py file:

from cryptography.fernet import Fernet

KEY_FILE = "vault.key"
VAULT_FILE = "recovery_codes.vault"

with open(KEY_FILE, "rb") as f:
    key = f.read()

fernet = Fernet(key)

with open(VAULT_FILE, "rb") as f:
    encrypted_data = f.read()

decrypted_data = fernet.decrypt(encrypted_data)
print(decrypted_data.decode("utf-8"))

Running the encryption script produces output like this, confirming the vault file was created successfully:

$ python3 encrypt_backup.py
New encryption key created: vault.key
Encrypted recovery_codes.txt into recovery_codes.vault
Store vault.key somewhere separate from recovery_codes.vault

$ ls -la
-rw-r--r--  1 user  staff    44 Oct 15 09:12 vault.key
-rw-r--r--  1 user  staff   312 Oct 15 09:12 recovery_codes.vault

This vault is not meant to replace a password manager. It is a lightweight, offline safety net specifically for the recovery codes your authenticator app migration generates, something most people otherwise leave sitting in an unencrypted notes app or a screenshot folder, which defeats the entire point of two factor authentication in the first place.

Step 12: Remove the Old App and Run a Final Recovery Test

Only now, after every account is confirmed working in the new app, backups are encrypted, and recovery codes are safely stored, should you remove accounts from your old authenticator app. Delete them one at a time rather than wiping the whole app at once, double checking against your Step 1 list that nothing was missed.

Finish with a real test. Put your iPhone in Airplane Mode, or better yet hand it to someone else for ten minutes, and try logging into one non critical account from your second device using only your new app and your recovery codes. If that works cleanly, your migration is done. If it does not, you still have time to fix it because you have not deleted the old app yet.

Common Pitfalls When Switching Authenticator Apps

Deleting the old app before confirming every account. This is the single most common cause of permanent lockouts. Keep the old app installed, untouched, until Step 12.
Forgetting the backup passphrase. An encrypted backup with a forgotten passphrase is unrecoverable by design, that is what encryption means. Write the passphrase down the moment you create it.
Treating a screenshot as a backup. Screenshots of QR codes or recovery codes often sync automatically to iCloud Photos, which puts sensitive secrets in a place with far broader access than you intend.
Skipping accounts that feel unimportant. Old email addresses and forgotten shopping accounts are exactly what attackers target first, since nobody is watching them closely.
Assuming passkeys replace your authenticator app entirely. Most services worldwide still only support TOTP codes. Dropping your authenticator app because you added a passkey somewhere else will lock you out of everything that has not caught up yet.
Not testing recovery before you need it. The only way to know your backup actually works is to test it while you still have access to everything, not during an actual emergency.

Troubleshooting Guide

The transfer QR code will not scan. Increase screen brightness on the device displaying the code, clean your camera lens, and make sure you are not trying to scan a screenshot of the code, which often loses resolution.
A code from the new app is rejected as invalid. Check that your iPhone’s date and time are set to update automatically under Settings, General, Date and Time. TOTP codes are time based and fail if the clock drifts even by a minute.
An account has no visible export or transfer option. Log into that account’s website directly, disable 2FA, then re-enable it to generate a fresh QR code for your new app.
The new app’s cloud backup option is grayed out. Confirm you are signed into the required account, Google, Microsoft, or iCloud depending on the app, and that you have an active internet connection during setup.
You lost your phone before finishing the migration. Use your recovery codes from Step 10 on each account individually, then set up 2FA fresh on your replacement device rather than trying to restore the old app’s state.
Passkeys are not appearing as an option on a service you expected. Confirm the account is accessed through Safari or a native app rather than an embedded browser inside another app, since some in app browsers block passkey prompts.
The Python encryption script fails with a “module not found” error. Run pip3 install cryptography again, and confirm you are running the script with python3 rather than an older python command.
You forgot which accounts you already migrated. Go back to your Step 1 paper list and check which entries are missing from the old app versus present in the new one, rather than trying to remember.
Your backup vault file will not decrypt. Confirm vault.key and recovery_codes.vault are both present in the same folder as the decrypt script, and that neither file was edited or re-saved by a text editor, which can alter encoding.

Advanced Tips for Power Users

Once the basic migration is done, a few extra moves make the setup noticeably stronger. First, if you manage accounts for a family or a small team, look for an authenticator app with shared vault support, such as 2FAS or Ente Auth, rather than emailing codes or secrets to each other, which defeats the purpose of having 2FA at all.

Second, for any account that supports it, register a hardware security key as a third method alongside your authenticator app and passkey. A physical key cannot be phished remotely the way a code can be relayed through a fake login page, and it survives a lost or wiped phone completely untouched.

Third, set a recurring reminder, every six months is reasonable, to revisit your Step 1 account list and prune anything you no longer use. Security hygiene decays quietly if nobody schedules time to check it, and an authenticator app full of dead accounts from closed services is just extra attack surface with no benefit.

Finally, if you rely on 2Stable or another Apple Watch compatible app, enable the watch complication for your most frequently used account so you are not reaching for your phone every time you need a code during the day. It is a small convenience, but it removes the temptation to disable 2FA on an account just because checking the code feels like friction.

If you manage devices for a small business rather than just yourself, treat this migration as a template rather than a one off project. Document which app your team standardizes on, where the encrypted backup credentials are stored, and who has authority to approve a new device enrollment when someone’s phone is lost, before an actual incident forces you to make those decisions under pressure. A written process, even a short one, turns a stressful lockout into a routine support ticket.

Frequently Asked Questions

What is the best authenticator app for iPhone in 2026?
There is no single best app for everyone. Google Authenticator wins on reach and simplicity, Microsoft Authenticator wins for Microsoft 365 users, and 2FAS Auth or Ente Auth win for anyone who wants encrypted backup with no account lock in. Pick based on the comparison table above rather than a single ranking.

Can I use Apple Passwords instead of a separate authenticator app?
Yes for any account where you only use Apple devices and the service supports Apple’s built in verification codes or passkeys. No if you also use Android or Windows devices day to day, since Apple Passwords does not sync codes to non Apple platforms.

Will switching authenticator apps lock me out of my accounts?
Only if you delete the old app before confirming every account works in the new one. Follow Steps 1 through 12 in order and keep the old app installed until the very last step to avoid this entirely.

Are passkeys safer than authenticator app codes?
Yes, passkeys resist phishing in a way six digit codes cannot, since there is no code to type into a fake login page. However, most services worldwide still do not support passkeys, so an authenticator app remains necessary for the near future.

What happens if I lose my iPhone and have not backed up my authenticator app?
You will need to use recovery codes saved when you first enabled 2FA on each account, or go through each service’s account recovery process individually, which can take days for some providers. This is exactly why Steps 7 and 10 above exist.

Is it safe to store 2FA recovery codes in a notes app?
Only if that notes app is not synced to the cloud, or if the codes are encrypted first. A cloud synced notes app with plain text recovery codes is a single point of failure if your Apple ID or Google account is ever compromised.

Do I need to keep SMS as a backup 2FA method?
Keep it only as a last resort fallback, never as your primary method. SMS codes can be intercepted through SIM swapping, and they offer no protection against the adversary in the middle attacks that have driven a large share of recent MFA bypass breaches.

How often should I review my authenticator app accounts?
Every six months is a reasonable cadence for most people. Treat it the same way you would treat reviewing old browser extensions or unused subscriptions, a small recurring task rather than a one time project.

What is the actual difference between two factor authentication and a passkey?
Two factor authentication through an app adds a second step, a six digit code, on top of a password you still have to type. A passkey replaces the password entirely with a cryptographic key pair, confirmed by Face ID or Touch ID, so there is no password for an attacker to steal or guess in the first place.

Can I use the same authenticator app across my iPhone, iPad, and a work laptop?
Yes, as long as the app supports encrypted cloud sync and you sign in with the same account on each device. Apple Passwords is the exception, since it only syncs across Apple devices through iCloud Keychain and will not help on a Windows or Android device.