However, the 4-digit PIN is not obsolete. Players can also choose to use the authenticator for their bank PIN instead of the fixed 4-digit PIN. Players can choose to trust the computers on which they play RuneScape for up to 30 days or choose to enter a code every time they wish to play. Jagex implements a 10-minute window (five minutes on either side of the actual time) to enter the correct code to allow for a possible lack of synchronisation between Jagex's server time and player devices. Once set up, players are prompted to enter the 6-digit time-based code whenever they log in to the game using an untrusted computer. The implementation generates a 6-digit code every 30 seconds based on the key and epoch time. Many mobile devices can read the barcode directly through their camera, which is equivalent to entering the Base32 string manually. Jagex generates a random 80-bit secret key unique to each user and presents it as a 2-dimensional barcode and as a 16-character Base32 string. To set up the RuneScape Authenticator, a player must visit the Authenticator landing page. This system works for both RuneScape 3 and Old School RuneScape, unlike the JAG did previously. This algorithm can be used both on supported mobile devices and in desktop implementations. It replaces the Jagex Account Guardian (JAG), by using an RFC-compliant time-based one-time password (TOTP) compatible with Google Authenticator.

The RuneScape Authenticator is an additional layer of protection players can utilise on their accounts. The warning players get if they do not have Authenticator active on their account.

Runescape mobile bank