‹ YuzoolGuideOpen app

Keybay guide

How to move Google Authenticator to a new phone

Keep the old phone until the end. In Google Authenticator on the old phone, choose Transfer accounts › Export accounts, pick the accounts, and scan the QR code it shows with the new phone. Check a code works on each site, and only then delete the accounts from the old phone.

Updated · 6 min read

Before you start

A two-factor code isn’t stored anywhere: the app works it out every 30 seconds from a secret key it was given when you scanned the site’s QR code, and the current time (the method is a public standard, TOTP). Moving codes to a new phone means moving those secret keys. Once a key is on the new phone, it makes exactly the same codes as the old one, so nothing changes on the websites.

  • Keep the old phone working until you’ve checked the new one. Don’t reset it or trade it in first: it’s the easy way back in.
  • Update Google Authenticator on both phones from the App Store or Google Play. Older versions don’t have Transfer accounts.
  • Find your backup codes for the accounts that matter most (email, bank, password manager). Most sites gave you a list when you turned on two-factor; it’s your safety net if anything goes wrong.

Move the codes with Transfer accounts

  1. On the new phone, install Google Authenticator and open it. When it offers to import existing accounts, choose that, or later use Transfer accounts › Import accounts from its menu. It asks to use the camera.
  2. On the old phone, open Google Authenticator, open the menu and choose Transfer accounts › Export accounts. Confirm it’s you (your screen lock or fingerprint).
  3. Tick the accounts to move (all of them, usually) and tap Next. The old phone shows a QR code. With many accounts it makes several, numbered “1 of 3” and so on.
  4. Scan each QR code with the new phone, in turn, until it says every account has been imported.
  5. On a few important sites, sign in with a code from the new phone to check it works.
  6. Only now, if you’re giving the old phone away, delete the accounts from it (the export offers to do this) and reset it.
Those QR codes are your keysAnyone who scans them gets working codes for your accounts. Do this somewhere private, don’t photograph them, and stop any screen sharing first.

Or let your Google Account sync them

Since 2023, Google Authenticator can save your codes to your Google Account. If you signed in to the app on the old phone (your profile picture shows at the top), sign in to Google Authenticator on the new phone with the same account and your codes appear. Check that every account is there before you rely on it.

Sync is convenient, but it means your two-factor keys sit in your Google Account, so that account’s own security matters even more. If you’d rather keep the keys off any cloud, use the QR transfer above and keep your own encrypted backup instead.

Moving to a different authenticator

The export QR codes use a format called otpauth-migration. Several other authenticators can read it, including Keybay on Yuzool:

  1. Open Keybay on the new phone or a computer with a camera, and make a master password. There’s no account.
  2. Tap +, then Scan a QR code.
  3. On the old phone, open Google Authenticator’s Transfer accounts › Export accounts and show the QR codes one after another. Keybay joins them up and lists what it found, skipping any code it already has.
  4. Tap Add them, check a code on a couple of sites, then save an encrypted backup from Settings.

Moving from other apps works the same way through Keybay’s Import from another app: 2FAS, Aegis, andOTP, Raivo and Bitwarden can export a plain file it reads. Delete that file afterwards: unlike the backup, it isn’t protected.

If the old phone is lost or broken

  • If sync was on, sign in to Google Authenticator on the new phone with the same Google Account.
  • If you have a backup from another authenticator (Keybay’s encrypted backup, for example), restore it with its password.
  • Otherwise, go account by account: sign in with one of the site’s backup codes, or use its account recovery (often a text or email check, sometimes ID). Then turn two-factor off and on again, which gives a new QR code to scan. The old phone’s codes stop working at that point, which is what you want if it was lost.

Start with your email account: most other accounts recover through it.

Never be stuck again

  • Keep an encrypted backup of your codes somewhere other than your phone: Keybay saves one as a small file that only opens with your master password, which you can keep on a USB stick or in cloud storage.
  • Keep each site’s backup codes, printed or in a password manager.
  • Add a second method where sites allow it, such as a passkey or a security key.
  • Write down your master password and keep it somewhere safe at home. An encrypted backup is only as good as your memory of its password: nobody can reset it.

Questions

Will my codes change when I move them?

No. A code is worked out from a secret key and the time, so the same key on the new phone gives exactly the same codes as on the old one. Nothing needs changing on the websites.

Can I keep my codes on both phones?

Yes. Exporting copies the keys; it doesn’t remove them. Both phones show the same codes until you delete them from one.

What if my old phone is lost or broken?

If you turned on Google Account sync, sign in to Google Authenticator on the new phone and the codes come back. If not, use each site’s backup codes or its account recovery to sign in, then turn two-factor off and on again to make a new key.

Are the transfer QR codes safe to screenshot?

Treat them like passwords. Anyone who scans them gets your codes. Don’t photograph them, share them or show them on a video call, and delete any picture you did take.

My codes on the new phone are wrong. Why?

Codes depend on the clock. Make sure the phone sets its date and time automatically. If only one account is wrong, it may have been set up again since your export: scan that site’s QR code afresh.

Sources