Google Authenticator
Our most-scanned candidate: 33 verified scans across 27 devices agree on two SDKs in Google Authenticator - Firebase and Google Sign-In. For a 2FA app that historically worked fully offline, both make sense only because of one product decision: since 2023 your one-time-code secrets can sync through your Google account. The Sign-In classes power that sync, and the INTERNET permission that a code generator would otherwise never need comes with it. Camera access is for QR enrollment, biometrics for the app lock. No ad, attribution, or third-party analytics SDKs.
Read from the bytecode.
The security question here is not tracking - it is sync. The verified SDKs exist to move your 2FA secrets through your Google account, which is convenient and also means your second factor is only as isolated as that account. If you use Authenticator without sync, the code in this APK still ships, but a code generator this popular carrying only Google-owned SDKs and zero ad-tech is, by our corpus standards, a clean result.
This is static analysis of the APK bytecode installed on real devices: it proves which SDK classes and manifest permissions ship in the app, not what the app transmits at runtime. Traffic analysis is a different measurement.
Hidden inside the code.
What it asks for.
An offline code generator would not need this - it ships with the account sync of your codes
QR code enrollment of new accounts - expected
Biometric app lock - protective feature
Keep reading.
How to Check If an Android App Is Safe Before Installing
Before you install any Android app, here is how to check if it is safe: permissions, trackers, developer reputation, and...
What is a tracker in an app, and why should you care
A tracker is third-party code the developer bundled in. It reads device IDs, coarse location and your app list, with no ...
Similar risk profiles.
Scan Google Authenticator yourself.
Get the full report on your device - with real-time DEX analysis, permission auditing, and breach monitoring. Free, no account needed.