Government Gateway Authenticator QR Code: How to Get HMRC App Access Code on a New Phone

To set up a Government Gateway authenticator QR code on a new phone, sign into your Personal Tax Account, navigate to your profile's sign-in settings, and scan the QR code with your preferred authenticator app. The whole process takes under five minutes.

What You Need Before Starting

What you'll need:

• Your Government Gateway user ID and password
• A smartphone (iPhone or Android) with an authenticator app installed
• Access to a desktop or laptop browser for the GOV.UK website
• Time estimate: 5 to 10 minutes
• Skill level: Beginner-friendly

What Changed with Government Gateway Authentication in 2026?

Government Gateway is HMRC's authentication service that lets UK taxpayers access Self Assessment, PAYE, VAT, and other tax services online. If you've recently switched phones, your two-factor authentication (2FA) setup doesn't transfer automatically. You need to re-link your authenticator app by scanning a new QR code through your Government Gateway profile.

The biggest shift in 2026 is the GOV.UK One Login rollout. According to Government Transformation, from 9 February 2026, new HMRC digital service registrants must use GOV.UK One Login instead of Government Gateway. If you already have a Government Gateway account, you can keep using it for now. But new registrants won't get the option to create one.

This matters for the authenticator QR code setup because the process differs depending on which login system you use. The steps below cover the existing Government Gateway route, which still applies to millions of current users. If you registered after 9 February 2026, skip ahead to the GOV.UK One Login section further down.

A quick note on QR code safety: the QR code you'll scan during this setup is generated directly by HMRC's servers and displayed on GOV.UK. Don't scan QR codes from emails, text messages, or unofficial websites claiming to be HMRC. According to Fox News, 73% of people admit to scanning QR codes without checking if the source is legitimate. Always verify you're on the official gov.uk domain before scanning anything.

Quick overview of the process:

1. Sign into Government Gateway — Log in with your existing user ID and password
2. Open your profile settings — Navigate to the sign-in details section
3. Access the QR code — Select "How you get access codes" and choose to change or add a method
4. Scan with your authenticator app — Use your new phone's authenticator to scan the displayed QR code
5. Verify and save — Enter the six-digit code from your app to confirm the link

Step 1: Sign Into Your Government Gateway Account

Before you can access the authenticator QR code, you need to get past the initial login. This is where most people hit their first wall, because the system still asks for a 2FA code from the app you can no longer access.

Detailed Instructions

1. Open a desktop browser and go to GOV.UK Personal Tax Account
2. Click "Sign in" and select "Government Gateway" as your sign-in method
3. Enter your 12-digit Government Gateway user ID and your password
4. When prompted for the access code, look for a link that says "I do not have access to my access codes" or "Get help with this"
5. Follow the alternative verification path. HMRC may send a code to your registered email address, ask security questions, or direct you to their helpline

If you still have your old phone (even without a SIM), open the authenticator app on it. The codes generate offline, so you don't need mobile signal or Wi-Fi. Enter the six-digit code from the old device to get through this step.

You'll know it's working when: You land on the Personal Tax Account dashboard showing your name, National Insurance number, and tax summary.

Common Mistakes and Troubleshooting

• Entering the code too slowly: HMRC access codes rotate every 30 seconds. If you take longer than that to type it in, the code expires and you'll get an "invalid code" error. Watch the countdown timer in your authenticator app and enter the code immediately after it refreshes.
• Confusing Government Gateway ID with your UTR or NI number: Your Gateway ID is a separate 12-digit number assigned when you created the account. It's not your tax reference. Check old emails from HMRC containing "Government Gateway" if you've forgotten it.
• Browser caching old session data: If you keep getting redirected to the login page after entering valid credentials, clear your browser cookies for *.gov.uk domains or try an incognito window.

Pro tip: I've helped dozens of users locked out of their Gateway accounts. The fastest path back in is the "I do not have access to my access codes" link on the login screen. It's easy to miss because it appears as small text below the code entry field, not as a button. If that link doesn't appear, try selecting "Text message" as your 2FA method instead, since HMRC may have your old phone number on file and you can request a code via SMS.

Step 2: Navigate to Your Profile and Sign-In Settings

Once you're logged in, you need to find the specific page where HMRC lets you manage your two-factor authentication methods. The interface has been updated since earlier versions, and the menu structure isn't obvious.

Detailed Instructions

1. From the Personal Tax Account dashboard, look for "Your profile" in the top navigation bar or side menu
2. Click on "Your profile" to open your account settings page at tax.service.gov.uk/personal-account/your-profile
3. Scroll down to the "Sign in details" section
4. Click "Change" next to your sign-in details

On some accounts, you'll see the settings split into separate categories: email address, password, and access code method. Look specifically for the access code or 2FA section.

You'll know it's working when: You see a page listing your current sign-in methods, including the authenticator app entry with options to change or remove it.

Common Mistakes and Troubleshooting

• Landing on the wrong profile page: HMRC has multiple profile sections. The one you need is under "Sign in details," not "Personal details" (which shows your address and contact info). If you see fields for your name and address, you're in the wrong section.
• The "Change" link not appearing: Some accounts have restricted editing based on verification level. If you signed in through an alternative method (email code or helpline override), you may need to complete an additional identity check before the system lets you modify 2FA settings.

Pro tip: Bookmark the direct URL https://www.tax.service.gov.uk/personal-account/your-profile for next time. The GOV.UK navigation changes periodically, but direct URLs to profile pages have stayed consistent. Having this saved cuts out two or three clicks every time you need to access your settings.

Step 3: Access the Authenticator QR Code

This is the step where you generate a fresh QR code that your new phone's authenticator app can scan. HMRC gives you two paths: changing the existing method or adding a new one alongside it.

Detailed Instructions

1. In the Sign-in details section, find "How you get access codes"
2. Click "Change" next to the authenticator app option
3. HMRC will display a new QR code on screen. This is a standard TOTP (Time-based One-Time Password) QR code that any compatible authenticator app can read
4. If you don't see a "Change" option, look for "Add another way of getting access codes" and select "Authenticator app for smartphone or tablet"

The QR code encodes a shared secret between HMRC's server and your authenticator app. Once scanned, both generate matching six-digit codes every 30 seconds. This is the same TOTP standard used by banks, email providers, and most online services.

If you want to understand more about how QR codes work at a technical level, this guide on what a QR code is covers the basics of encoding and scanning.

You'll know it's working when: A black-and-white QR code appears on your screen, along with a manual entry key (a long alphanumeric string) as a fallback option below it.

Common Mistakes and Troubleshooting

• QR code not displaying: Some ad blockers and browser security extensions block the QR code image from rendering. If you see a blank space where the code should be, temporarily disable your ad blocker or try a different browser. Firefox and Chrome on desktop both render it consistently.
• The page times out before you can scan: The QR code page has a session timeout (usually around 15 minutes). If you haven't scanned it yet and the page refreshes to the login screen, sign in again and regenerate the code. Don't worry; the old code is automatically invalidated.
• Accidentally clicking "Remove" instead of "Change": If you remove your authenticator without setting up a new one first, you'll lose 2FA entirely and need to re-enable it from scratch. Always add the new method before removing the old one.

Pro tip: Before scanning the QR code, take a screenshot and store it in a secure location (encrypted note app or password manager). If you ever switch phones again, you can scan the QR code from the screenshot instead of going through this entire process again. Just make sure the screenshot is stored securely, since anyone with access to it could generate valid access codes for your tax account.

Step 4: Scan the QR Code With Your Authenticator App

Now you'll connect your new phone to Government Gateway by scanning the QR code you generated in the previous step. The process varies slightly between iPhone and Android, and between different authenticator apps.

Setup on iPhone

1. Open your authenticator app (HMRC app, Google Authenticator, or Microsoft Authenticator)
2. Tap the "+" button (usually in the top-right or bottom-right corner)
3. Select "Scan QR code" or "Scan a barcode"
4. Point your iPhone camera at the QR code displayed on your desktop screen
5. The app will automatically detect and add the HMRC account entry

If your iPhone camera can't focus on the screen, increase your desktop monitor's brightness and hold the phone 15 to 20 centimetres away. Reducing screen glare by angling the monitor helps too.

Setup on Android

1. Open your authenticator app on your Android device
2. Tap "+" then "Scan a QR code"
3. Grant camera permission if prompted (Settings > Apps > [Your Authenticator] > Permissions > Camera)
4. Align the QR code within the viewfinder frame
5. The account entry appears automatically once scanned

On Android devices running Android 14 or later, you might need to grant the camera permission each time if you have the "Ask every time" privacy setting enabled. Check your app permissions if the camera doesn't activate.

Manual Entry Fallback

If scanning doesn't work (cracked screen, camera issues, or accessibility needs), use the manual key:

1. In your authenticator app, tap "+" then select "Enter a setup key" or "Manual entry"
2. For Account name, type something recognisable like "HMRC Government Gateway"
3. For Key, carefully enter the alphanumeric string shown below the QR code on the GOV.UK page
4. Make sure Time-based is selected (not counter-based)
5. Tap "Add" or "Save"

You'll know it's working when: Your authenticator app shows a new entry labelled "HMRC" or "Government Gateway" with a six-digit code that changes every 30 seconds.

Common Mistakes and Troubleshooting

• Wrong time on your phone: TOTP codes depend on your device clock being accurate. If the generated code keeps being rejected, go to Settings > General > Date & Time (iPhone) or Settings > System > Date & Time (Android) and enable "Set automatically." Even a 30-second drift can cause codes to fail.
• Scanning with the phone's camera app instead of the authenticator app: Your phone's default camera will recognise the QR code as a URL and try to open a web page, which won't work. Always scan from within the authenticator app itself.

Pro tip: Set up the same HMRC account on two authenticator apps (for example, Google Authenticator on your phone and Microsoft Authenticator on a tablet). Scan the QR code with both devices before clicking "Continue" on the GOV.UK page. Both apps will then generate valid codes, giving you a backup if one device breaks or gets lost. HMRC doesn't restrict how many devices can share the same TOTP secret.

Step 5: Verify the Code and Complete Setup

The final step confirms that your authenticator app is properly linked to your Government Gateway account. HMRC needs you to prove the QR code was scanned correctly by entering a valid code.

Detailed Instructions

1. On the GOV.UK page (still showing the QR code), click "Continue" or "I've scanned the QR code"
2. Open your authenticator app and read the current six-digit code for the HMRC entry
3. Enter that code into the verification field on the GOV.UK page
4. Click "Submit" or "Verify"
5. If you had an old authenticator entry, go back to "How you get access codes" and remove the old method to avoid confusion

You'll know it's working when: GOV.UK displays a confirmation message saying your access code method has been updated. Your profile page will show the authenticator app as your active 2FA method.

Common Mistakes and Troubleshooting

• Entering an expired code: If your authenticator shows a code with only 2 to 3 seconds remaining on its timer, wait for the next code. Entering a code right as it expires almost always results in rejection.
• Copying the code from the wrong account entry: If you have multiple TOTP entries in your authenticator (Gmail, bank, HMRC), make sure you're reading the code from the newly added HMRC entry, not an old one.

Pro tip: After completing setup, immediately sign out of Government Gateway and sign back in using the new authenticator code. This confirms the entire end-to-end flow works before you walk away. I've seen people complete setup successfully but then struggle at the next login because their authenticator app had the wrong time zone, which only manifests when trying to log in from scratch.

How to Use Third-Party Authenticator Apps With Government Gateway

You don't have to use the official HMRC app. Government Gateway's QR code follows the standard TOTP protocol (RFC 6238), which means any compatible authenticator app will work. Here's how the main options compare:

Google Authenticator added cloud sync in 2023, which means your TOTP secrets back up to your Google account. When you get a new phone and sign into Google, your authenticator entries restore automatically. This is the single best way to avoid the "locked out after phone switch" problem entirely.

Microsoft Authenticator offers similar cloud backup tied to your Microsoft account. If you use Outlook or Office 365 for work, consolidating here makes sense.

Authy stands out because it works on desktop computers, not just phones. If your phone dies, you can still generate codes from your laptop. It also encrypts backups with a separate password, adding a layer of protection that the others lack.

The HMRC app itself doesn't support cloud backup or multi-device sync. If you switch phones, you'll need to go through this QR code setup process again every time. For that reason alone, a third-party app with backup capabilities is worth considering.

What if You're Not a UK Citizen or Resident?

Non-UK citizens and residents face additional identity verification hurdles. The standard GOV.UK verification flow relies on a UK passport, UK driving licence, or UK bank account records. If you don't have any of these, the online identity check will fail.

Your Options

• Call the HMRC helpline directly: Phone 0300 200 3600 (from the UK) or +44 161 930 8445 (from outside the UK). Lines are open Monday to Friday, 8am to 6pm UK time. Ask for the "online services helpdesk" specifically.
• Use HMRC webchat: Available through HMRC's online services helpdesk page. Webchat tends to have shorter wait times than phone, especially mid-morning on weekdays.
• Request a paper verification: HMRC can post an activation code to your registered address (including international addresses). This takes 7 to 10 working days for UK addresses and up to 21 days internationally.

For non-UK residents who are self-employed or have UK property income, you'll still need a Government Gateway account (or GOV.UK One Login from February 2026) to file Self Assessment returns. The authenticator QR code process works identically once you've passed the identity check. The only difference is how you prove your identity in the first place.

What to Do if Your Government Gateway QR Code Is Not Working

QR code scanning failures during Government Gateway setup fall into a few predictable categories. Here's what to check:

If none of these fixes work, use the manual entry key displayed below the QR code. Copy the alphanumeric string character by character into your authenticator app. This bypasses the camera entirely and achieves the same result.

GOV.UK One Login: What It Means for Government Gateway Users

GOV.UK One Login is the UK government's replacement for Government Gateway and GOV.UK Verify. The transition started in 2024 and reached a major milestone in February 2026 when new HMRC registrants were required to use One Login exclusively.

Here's what this means for you:

• Existing Government Gateway users: Your account still works. HMRC hasn't announced a mandatory migration deadline yet. Continue using your Government Gateway authenticator as normal.
• New users (registered after 9 February 2026): You'll use GOV.UK One Login from the start. The authentication setup is different. One Login uses its own app or SMS-based verification, not the Government Gateway QR code method.
• Planning ahead: When the full migration eventually happens, HMRC will guide you through linking your existing Gateway account to a new One Login profile. Your tax data and history will transfer.

According to Wave Connect, over 102 million Americans will scan QR codes in 2026, reflecting how widespread QR-based authentication has become globally. The UK government's continued use of QR codes for 2FA setup aligns with this broader trend toward mobile-first verification.

For more on how QR code adoption is growing across industries, including government services, healthcare, and retail, that breakdown covers the latest data.

How to Recover Your HMRC Access Code Without Your Old Phone

Lost your phone entirely? No access to the old authenticator? Here's the recovery path, in order of speed:

1. Check for cloud backup: If you used Google Authenticator (with sync enabled), Microsoft Authenticator, or Authy, sign into that service on your new phone. Your HMRC entry may restore automatically.
2. Check for a screenshot: If you saved the original QR code as an image, scan it again from your new phone's authenticator app.
3. Use the "I can't access my code" link: On the Government Gateway login page, this link triggers alternative verification (email code, security questions, or phone call).
4. Call HMRC: Phone 0300 200 3600 and request an access code reset. You'll need to verify your identity verbally. Have your National Insurance number and Government Gateway user ID ready.
5. Visit a GOV.UK Verify location (if applicable): For complex identity issues, HMRC may direct you to an in-person verification appointment.

The entire recovery process typically takes 15 to 30 minutes if you reach the helpline. On busy days (January and April, coinciding with tax deadlines), wait times can stretch to an hour or more. The webchat option is often faster.

Tools Mentioned in This Guide

Frequently Asked Questions

How do I add Government Gateway to an authenticator app?

Sign into your Personal Tax Account at gov.uk, go to Your Profile > Sign-in details > How you get access codes, and click "Change." A QR code will appear on screen. Open any TOTP-compatible authenticator app (Google Authenticator, Microsoft Authenticator, Authy, or the HMRC app), tap the "+" button, select "Scan QR code," and point your camera at the screen. The app adds the account automatically and starts generating six-digit codes.

How do I restore my authenticator QR code on a new phone?

You can't restore the original QR code directly. Instead, sign into Government Gateway, navigate to your profile's sign-in settings, and generate a fresh QR code. Scan this new code with your new phone's authenticator app. If you saved a screenshot of the original QR code, you can also scan that screenshot directly. Apps with cloud backup (Google Authenticator with sync, Microsoft Authenticator, Authy) may restore the entry automatically when you sign in on a new device.

What should I do if the Government Gateway QR code is not scanning?

First, make sure you're scanning from inside the authenticator app, not your phone's regular camera. Increase your computer screen brightness and hold your phone 15 to 20 centimetres from the screen. If it still won't scan, check whether an ad blocker is hiding the QR code image. As a fallback, use the manual entry key shown below the QR code on the GOV.UK page. Type that key into your authenticator app's "Manual entry" option instead.

How do I set up the HMRC authenticator on Android in 2026?

Download the HMRC app or Google Authenticator from the Google Play Store. Sign into Government Gateway on a desktop browser, navigate to Your Profile > Sign-in details > How you get access codes, and click "Change." On your Android device, open the authenticator app, tap "+", then "Scan a QR code." Grant camera permission if asked. Point the camera at your computer screen and the entry adds automatically. Enter the displayed six-digit code on the GOV.UK page to confirm.

Can I use a third-party app for Government Gateway 2FA?

Yes. Government Gateway uses the standard TOTP protocol, which works with any compatible authenticator app. Google Authenticator, Microsoft Authenticator, and Authy all work. Third-party apps often offer advantages over the official HMRC app, including cloud backup, multi-device sync, and desktop access. The setup process is identical: scan the QR code, verify with a six-digit code, and you're done.

How do I recover my HMRC access code without my old phone?

On the Government Gateway login page, click "I do not have access to my access codes" to start the alternative verification process. HMRC may send a code to your registered email or ask security questions. If online recovery fails, call the HMRC helpline at 0300 200 3600 (or +44 161 930 8445 from abroad) and ask for an access code reset. You'll need your Government Gateway user ID and National Insurance number. Also check if your authenticator app backed up to the cloud, as the entry may restore on your new device automatically.

Keep Your Government Gateway Account Secure Going Forward

Setting up your Government Gateway authenticator QR code on a new phone takes five minutes when you know where to look. The key steps are: sign in, find your profile's sign-in settings, generate a fresh QR code, and scan it with your authenticator app of choice.

To avoid going through this process again next time you switch phones, use an authenticator app with cloud backup like Google Authenticator (with sync enabled) or Authy. And save a screenshot of the QR code in a password-protected location.

With the GOV.UK One Login transition underway, keep an eye on GOV.UK's official guidance on security codes for updates about when existing Government Gateway accounts will need to migrate. For now, the QR code method still works exactly as described above.

If you work with QR codes beyond government authentication, for marketing, events, product packaging, or customer engagement, QRCode.co.uk lets you create custom, trackable QR codes with scan analytics and no sign-up required.