FortiToken Mobile

The first thing that happens after installing FortiToken Mobile is not generating a code—it's hitting a wall. The app opens to a blank screen with a plus icon, and that's where the confusion starts. You need an activation key, a QR code, or a redemption certificate from your Fortinet administrator. Without that, the app does nothing. It sits there, waiting. This is not a standalone authenticator like Google Authenticator. It is a client component of Fortinet's ecosystem, and it requires FortiOS, FortiAuthenticator, or FortiToken Cloud as the backend validation server. Many users never get past this initial step because they don't have the necessary credentials or don't understand what the app actually needs.

Once you have the activation material, the setup process is relatively straightforward. You tap the plus icon, choose between scanning a QR code or entering the activation key manually, and the token appears on the home screen. The QR code scanner works quickly, provided the camera permission is granted. For manual entry, you need to type a 20-digit activation code exactly as it appears in the activation email—no typos allowed. The app then displays a six-digit OTP that refreshes every 30 seconds. You can copy this code to the clipboard by pressing and holding on it, which is useful when pasting into a VPN client or web portal. The interface is minimal: a list of tokens, each showing the current code and a countdown timer. There are no settings menus, no customization options, and no obvious way to remove a token once it's added.

The QR Code Workflow and Its Hidden Dependency

The QR code scanning feature is the fastest way to activate a token, but it hides a critical dependency. The QR code must be generated by the Fortinet backend—FortiOS, FortiAuthenticator, or FortiToken Cloud. You cannot use a generic QR code from any other source. This means the app is useless without enterprise infrastructure. For a small business or an individual user, this is a dealbreaker. The app is not designed for personal use; it is designed for organizations that already have Fortinet products in place. The QR code contains the token seed encrypted, and the app decrypts it using the backend's validation. If the backend is misconfigured, the QR code scan fails, and the user is left with no clear error message—just a generic failure notice.

Once the token is activated, the app generates OTPs based on both time and event-based algorithms, compliant with OATH standards. The time-based codes refresh every 30 seconds, while event-based codes change only when a new event triggers them. This dual-mode capability gives administrators flexibility in how they deploy authentication. For VPN access, time-based OTPs are the norm. For transaction approvals, event-based OTPs might be used. The app handles both seamlessly, but the user never sees which mode is active—the codes look identical. This lack of visibility can be confusing, especially when troubleshooting why a code isn't working. A user might enter a code that has already expired, or they might use an event-based code out of sequence, and the app provides no feedback to explain the failure.

When the App Breaks: Real-World Performance Issues

The app has a documented history of stability problems. Users report that it crashes, freezes, or fails to generate codes on older Android devices. The Play Store reviews include complaints about the app not working at all, with one user stating "every thing is bad about this app." Another user described a "500 Internal Server" error when assigning tokens through FortiAuthenticator, which required a backend fix. Push notifications, which are used for approving authentication requests, have been reported as lagging or not working at all, especially on devices with poor network quality. This is a critical issue because push notifications are the primary way users approve login attempts without typing a code. If the notification doesn't arrive, the user cannot complete the authentication flow.

The app also suffers from compatibility problems. The Play Store listing states that it supports Android 5.0 through Android 11, but newer versions of Android (12 and above) are not explicitly mentioned. This creates uncertainty for users with modern devices. One user on a Pixel 9 reported notification issues after a Google update, suggesting that the app may not keep pace with Android's evolving permissions model. The app requires the camera, internet, and the ability to keep the device awake during database upgrades. These permissions are necessary, but they also raise privacy concerns—though Fortinet states that the app cannot change settings, take photos, record audio, or read emails without permission.

The Transfer Problem: A Policy Change That Breaks Workflows

One of the most significant limitations of FortiToken Mobile is the inability to transfer tokens between devices. This is not a technical limitation—it's a policy change. Fortinet updated its license terms in August 2025, stating that FortiToken Mobile tokens purchased after that date will not be transferable except for RMA cases. This means that if a user gets a new phone, they cannot simply reinstall the app and restore their tokens. They must request a new token from their administrator, which involves deactivating the old token and provisioning a new one. This process can take hours or days, depending on the organization's IT response time. For users who rely on the app for daily VPN access, this is a major disruption. One Reddit user described being locked out of their FortiGate firewall because their phone failed and they couldn't transfer the token.

The transfer issue is compounded by the lack of documentation. Multiple reviews mention that there is no clear guide on how to transfer tokens, and even Fortinet's official documentation is sparse on this topic. Users are left to figure out the process through trial and error, often resulting in frustration and lost productivity. The app does not include a built-in backup or export feature, which is standard in many other authenticator apps. This omission is a deliberate design choice by Fortinet, likely for security reasons—preventing token seeds from being extracted and reused. However, it places a significant burden on end-users and administrators alike.

The Permission Model and What It Actually Does

The app requests several permissions: camera, TouchID/FaceID, internet, and the ability to keep the device awake. The camera is used exclusively for scanning QR codes during token activation. TouchID/FaceID provides an additional layer of security, requiring biometric authentication before the app displays OTP codes. Internet access is needed for token activation and push notifications. The "keep awake" permission is used during internal database upgrades to prevent data corruption. Fortinet explicitly states that the app cannot change settings, take photos, record audio, read emails, view browser history, or remotely wipe the device. This transparency is reassuring, but it also highlights the app's limited scope—it does nothing beyond generating OTPs and receiving push notifications. There is no built-in backup, no cloud sync, and no integration with other authenticator apps. It is a single-purpose tool, and it does that one purpose reasonably well when everything works.