How to get two-factor codes on a flip phone

Two-factor authentication is the single biggest reason people keep a smartphone they do not want. Your bank, your email, your insurance portal: they all want a six digit code, and they all assume you have an app for it.

There are three ways to handle this on a flip phone. Each has real tradeoffs.

1. SMS codes

Most services can send a code by text message instead of using an app. This is the simplest option and it works on any phone.

The downsides are real. SMS codes do not arrive without signal, which matters if you are in a basement or a rural dead zone. They are also less secure: a phone number can be transferred to another SIM without your knowledge, and text messages are not encrypted in transit.

For most people this is good enough. If you only need codes for one or two accounts and you have reliable signal, there is no reason to overcomplicate it.

2. An authenticator app on the flip phone

If your flip phone runs Android (most American flip phones sold in the last few years do), it can run an authenticator app that generates codes the same way Google Authenticator or Authy does on a smartphone.

The codes are calculated from the clock and a stored secret, so they work with no signal at all. They are also immune to SIM swapping, because nothing is sent by text.

The hard part is setup. Most authenticator apps are designed for a touchscreen, which a flip phone does not have. And adding an account usually means scanning a QR code, which requires a camera app that can read them.

3. A hardware security key

A YubiKey or similar USB key plugs into a computer and handles authentication with a tap. No phone involved at all.

This is the most secure option, but it only works with services that support it (most banks do not), and it requires a computer. If you are standing in a field trying to sign in to something on your phone, a USB key does not help.

What to do about existing accounts

If your codes are currently in Google Authenticator on a smartphone, you can export them before you put the smartphone away. Open Google Authenticator, go to the menu, and choose Transfer accounts, then Export. It shows a QR code that contains every account at once. Scan that with whatever you are moving to.

If you are using SMS codes today and want to switch to an authenticator, go to the security settings of each service and look for an option called Authenticator app or TOTP. It will show a QR code to scan. Do this one account at a time and confirm each one works before removing the SMS option.