The one-time passwords generated by Authenticator are used for two-factor authentication. Traditionally, a website login page will ask you to authenticate yourself using something you know – your password. Two-factor authentication improves security by also asking you to authenticate yourself using something you have – your iPhone, or whatever device you are using to generate one-time passwords.

When you set up two-factor authentication, a website provides you with a secret, which Authenticator stores securely in the iOS keychain. When you use Authenticator to log in, it uses that secret and the current time to generate a unique password. This time-based password proves to the website that the person trying to log in is currently in possession of the physical device which contains the secret.

Syncing your secret tokens to other devices would invalidate the posession factor, introducing the possibility of an attacker stealing your secret tokens without having physical access to your phone. The same holds true for cloud-based backups. To maintain the security of keeping the tokens limited to a physical device, the tokens follow the same backup rules as other passwords saved in the iOS keychain – they are only included in a backup if that backup is encrypted.

To ensure your tokens are backed up, please make an encrypted backup of your phone using iTunes. Also, please be sure to write down the "recovery codes" each website gives you when you set up two-factor authentication, and keep them in a safe place.