Can you use 2FA codes without a phone? Yes. Here's the honest tradeoff
No phone, an old phone, a work phone you can't install apps on, or you're tired of reaching for it. You can get authenticator codes on your computer. Here's what that protects, what it gives up, and how to do it without risking a lockout.
Yes, it works on almost any site
Authenticator codes follow an open standard (RFC 6238). A site that offers authenticator app codes doesn't know whether the app runs on a phone or a computer. The code is the same.
What codes on your computer still protect
With 2FA on, a stolen or leaked password isn't enough on its own: someone also needs a code from your device. That's true whether the codes come from your phone or your computer.
What you give up
With codes on the same computer as your passwords, both "factors" live on one device. If someone gets full control of your computer, with malware or by using it unlocked, they may be able to get both. A phone keeps the second factor on a separate device, which is stronger.
So, honestly: codes on your computer are much better than no 2FA, and a bit weaker than codes on a separate phone. For most people, the bigger everyday risk is getting locked out, so plan for that.
How to do it safely
- Use an authenticator with backups you hold. Never Lose Codes writes an encrypted backup file to Downloads/NeverLoseCodes after every change.
- Keep your recovery key away from the computer. It's the only thing that opens your backups if the computer dies.
- Copy a backup file off the computer now and then, to a USB stick or another place you control.
- Save each site's recovery codes when you turn on 2FA, somewhere that isn't your computer.
- Set an app password if anyone else uses your computer.
- Put your email account's codes in two places if you can. Your email can usually reset everything else.
Questions
Isn't text-message 2FA easier?
It is, but it needs a phone number that receives texts. Authenticator codes don't depend on a phone number or a signal.
What if I get a phone later?
You can copy your accounts to it: How to copy your 2FA codes from Chrome to your phone.
Does Never Lose Codes send my codes anywhere?
No. It has no access to websites and doesn't send your codes, account names or backups anywhere. Codes are made on your computer. The security page has the details, and the source code is public on GitHub.
Never Lose Codes is a Chrome extension that keeps your 2FA codes encrypted on your computer, with backup files you hold and a recovery key. See how it works.