How to Move Your 2FA Codes to a New Authenticator App

Last updated: November 5, 2026 · Steps checked against Twilio (Authy), Google, 2FAS, Aegis, and Bitwarden help pages (sources at the bottom)

We may earn a commission if you buy through links here — it never changes our picks.

Sooner or later everyone with an authenticator app faces the same job: a new phone, a better app, or an app that stopped working, and a screen full of six-digit codes that need to move house. Two quick definitions first. 2FA (two-factor authentication) is the second proof at sign-in, after your password. An authenticator app produces that proof as a TOTP code, a six-digit number that changes every 30 seconds. App and website agree on those codes because they share a secret, created when you scanned the setup QR code. That secret is called the seed (or secret key), and whoever holds it can generate your codes.

That is why moving codes is easy from some apps and impossible from others. If an app will show you the seeds again, moving is a five-minute export. If it won't, the only way out is to visit every account and set up the codes again from scratch. This guide covers both, with Authy front and center.

Before you start

What you need

Your old phone, still working, with the old app on it. If you have it, everything below is a chore. If you don't, skip to the lost-phone section.
Both phones side by side. Every safe method here uses the old app to approve or feed the new one. Do not wipe or reset the old phone until the very last step says so.
Your passwords handy. Re-enrolling means signing in to each account and opening its security settings. A password manager makes this much faster.
Somewhere safe for new recovery codes. Several accounts will hand you fresh ones during this process. They need a home that is not a screenshot on the phone you are about to retire.

The honest headline: Authy has no export

If you came here searching for how to export your keys out of Authy, here is the straight answer, in Twilio's own framing: the Authy app has no export feature. No button, no file, and no QR code hands your seeds to another app. Twilio's help pages say the way out is to re-enable the two-factor method at each account and add the token again in your new app. Account by account, by hand.

Two related facts explain why so many people hit this wall at once:

The Authy desktop apps are gone. The Windows, Mac, and Linux apps reached end of life on March 19, 2024, and old installs were invalidated. Authy is a phone and tablet app now. If your codes "lived on your computer," that copy no longer works.
What Authy does offer is movement inside Authy. Its Backups feature keeps an encrypted copy of your tokens on your account, and Multi-Device lets a new phone join and sync them down. That moves codes from an old phone to a new phone. It does not get them out of Authy.

So "moving my codes" is really three jobs: Authy to a new phone, leaving Authy for a new app, and moving out of Google Authenticator, the lucky case, because Google built a real transfer feature. Then the lost-phone playbook and picking a new app that will never trap you like this.

Job 1: Authy to a new phone (staying in Authy)

If the new phone is the only change, this is the easy job, but the order matters. Twilio's warning is blunt: before you switch devices, make sure Multi-Device and Backups are both enabled on the old phone, and that you know your backups password. Skipping that check is how people lose tokens permanently.

On the old phone, turn on Backups

Open Authy, open Settings, and turn on Authenticator Backups (in the Accounts area of settings). If you have never set a backups password, you will create one now. It encrypts your tokens before they leave the phone, and Authy cannot recover or reset it for you, ever. Store it in your password manager before you move on.

On the old phone, allow multi-device, briefly

Tap the gear icon for Settings, go to Devices, and turn on Allow multi-device. This setting permits a new installation to join your account, and it can only be changed from a device already on the account.

Install Authy on the new phone and register it

Install Authy on the new phone and register with the same phone number as the old one. Approve the new installation using the existing device when Authy offers that option (or by SMS). Enter your backups password when asked, so the synced tokens can decrypt.

You should now see: your full list of accounts on the new phone, generating codes.

Test before you tidy up

Sign in to one or two important accounts using codes from the new phone. Only once they work, go to Settings → Devices, turn Allow multi-device off again (Twilio recommends leaving it off, so no new device can be added behind your back), and remove the old phone from the device list.

Job 2: Leaving Authy for a different app (the re-enrollment workflow)

Moving to a different app means setting up each account's codes again. There is no way around it, and anyone selling one is selling you a risk (see the tools section below). The good news: it is mechanical, and the right order keeps it safe. Budget an evening for a long list, or do the top tier now and the rest as you next sign in to each site.

Work in this order, because the accounts are not equal:

First: your email account. Email is the master key. Password resets and recovery for almost everything else land there, so it gets its new code first, while the old one still works.
Second: money. Banking, payment apps, and anything that can move funds.
Third: the master accounts. Your password manager's own 2FA, and your Apple, Google, and Microsoft accounts. (While you are in their security settings, consider turning on passkeys too. It is the stronger long-term fix.)
Then: everything else, a few at a time. Social, shopping, work tools. Nobody re-enrolls forty accounts in one sitting.

The routine for one account

Sign in to the account, using a code from the old app as your second factor. Open its security settings and find the authenticator section. Choose the option to change or set up the authenticator app. Some sites make you turn it off and back on; some show a fresh QR code straight away. Either route ends at the same screen: a new QR code (or a setup key you can type).

Scan it with the NEW app, then prove it works

Add the account in your new app by scanning that QR code. The site will ask you to type a code to confirm setup. Type the code from the new app, not the old one. That confirmation is the moment the account switches over: from now on, only the new app's codes are valid for it.

Save the fresh recovery codes

Many sites issue new recovery codes (also called backup codes) when you change your two-factor setup, and the old ones may stop working. Save the new set in your password manager, on the item for that account. This process is exactly when they quietly rotate.

Mark it done, move to the next account

Keep a simple list as you go: account name, done or not. Only when every account is confirmed working in the new app can you remove the tokens from the old app and uninstall it. Until then, the old app is your safety net. Never delete it partway through.

Job 3: Moving out of Google Authenticator (the app with a real export)

Google Authenticator shows what the friendly version of this job looks like, and many people hold codes in both apps. It has two routes:

Sync: if you use Google Authenticator signed in to your Google Account, your codes sync to that account. Install the app on the new phone, sign in to the same account, and the codes appear.
Manual transfer: if you use it without an account, or you are moving codes into a different app that can read Google's transfer codes, use the built-in transfer feature:

Export on the old phone

On the old phone, open Google Authenticator, open the Menu, and tap Transfer accounts, then Export accounts. Unlock the phone when asked, select the accounts to move, and tap Next. The app shows a QR code. With many accounts selected, it may show several, one after another.

Import on the new device

For Google Authenticator on the new phone: install the app, tap Get Started, and either sign in (sync route) or open Menu → Transfer accounts → Import accounts and scan the QR code or codes from the old phone. You will get a confirmation that the codes transferred. Many other authenticators, including 2FAS, can also scan that same export QR code, which makes Google Authenticator the easiest app to leave.

Verify, then retire the old copy

Check every account appears in the new app and test a couple of sign-ins. Treat that export QR code like the keys themselves while it is on screen: it contains your seeds, so never screenshot it or send it to anyone.

If the old phone is already gone

This is the harder version of the job. No app can hand back codes that existed only on a lost device. What you can do depends on what you set up beforehand. Work through these in order:

Another device still signed in? If Authy works on a second device, such as a tablet, use it. From there you can approve a new phone (Settings → Devices → Allow multi-device) and remove the lost one. This is the entire reason Twilio recommends running Authy on two devices.
Recovery codes. For each account, look for the recovery codes you saved when you first turned on 2FA. Signing in with one gets you back into the account, where you can turn the authenticator off and set it up fresh in your new app. It is the fastest route for your most important accounts.
Authy account recovery. If you still control the phone number on the Authy account, start Authy's account recovery from its recovery page (linked at the bottom). The process takes 24 hours and cannot be rushed or bypassed by support. When it completes, your existing Authy installations stop working and you register a fresh one. Crucially, recovery only brings back tokens that were backed up, and only if you still know your backups password. Tokens that were never backed up are gone.
Each service's account recovery. For accounts with no recovery codes and no surviving backup, the last route is the service's own identity-check recovery: ID checks at banks, support tickets elsewhere. It is slow by design. Do your email account first, because recovery mail for the rest lands there.

Once you are back in, set up your new app properly this time, backup switched on, and save every account's recovery codes as you re-enroll it.

Pick a new home that can export

The lesson here is not that Authy is uniquely bad. It is that an authenticator without an exit is a trap you only discover when you try to leave. When you choose where your codes live next, "can I get my codes out again?" belongs on the checklist. Three solid patterns, all verified against the makers' own docs:

2FAS (iPhone and Android). Keeps tokens on your device, with optional encrypted backup and sync through your own Google Drive or iCloud. It can export a backup file and import one on another device, and the export can be password-protected, which matters, because an unprotected export file contains your secret keys in readable text. It also imports by scanning Google Authenticator's transfer QR code.
Aegis (Android only). Stores everything in an encrypted vault on the phone, with no account and no cloud of its own. It supports manual exports of the vault, encrypted or plain, plus automatic backups to a folder you choose. Your codes never sit on someone else's server, and you are never locked in.
Your password manager's built-in authenticator. Bitwarden, for example, can store the authenticator key on each login item in your vault and generate the codes right there, and its separate free Authenticator app can sync with the vault. One honest trade-off: password and code in one vault is convenient, but it puts both factors in one basket. Many people accept that for personal accounts; for sensitive accounts, a separate app keeps the factors genuinely separate. Our password manager setup guide covers setting the vault up safely.

Whichever you pick, do the two-minute setup future-you will be grateful for: turn its backup or sync on, store its backup password in your password manager, and make one test export, so you know the exit works before you need it.

The tools to avoid: unofficial "Authy export" hacks

Search for "Authy export" and you will find scripts and hacks promising to pull your seeds out of Authy's app data or a rooted phone. Our advice: do not use them, for three reasons that follow from what a seed is.

The output is the keys themselves. A successful extraction produces the raw secrets for every account you own, usually as a plain text list. Anyone, or anything, that gets that file can generate your codes forever, and you would never know.
The tools ask you to lower every guard. Typical instructions involve rooting or jailbreaking the phone, or feeding your Authy data into a stranger's script. Each step hands your most sensitive secrets to the least accountable software on your device.
Extraction defeats the design you chose 2FA for. Every authenticator's security model assumes the seed stays inside the app. Pulling it out by force voids that model for all of your accounts at once.

The slow method is the safe method. An evening of re-enrolling beats wondering who else has your keys.

Common mistakes

Wiping or trading in the old phone first. Every easy path here needs the old app alive. Phones get wiped last, after the test sign-ins pass.
Forgetting the Authy backups password. Authy cannot reset it, and account recovery does not reset it either. Without it, your backed-up tokens cannot be decrypted on a new device. Store it in your password manager.
Leaving multi-device on afterward. It is a door you open to add a phone and close right after. Left open, it stays open to anyone who can register your number.
Losing the new recovery codes. Changing your authenticator often rotates an account's recovery codes. Save the fresh set each time, or the codes in your drawer may be worthless when needed.
Screenshotting transfer QR codes. An export or setup QR is the seed in picture form, and screenshots sync to photo clouds and linger in galleries. Scan device to device, in the room, and move on.

The whole job, as a checklist

Summary

Authy has no export. Leaving Authy means re-enrolling each account at the site itself.
Staying in Authy on a new phone: Backups and Allow multi-device on first, register with the same number, enter the backups password, test, then turn multi-device back off.
Leaving for a new app: re-enroll in order. Email, money, master accounts, then the rest. Confirm each with a new-app code and save the new recovery codes.
Google Authenticator is the exception: use its Transfer accounts export QR, or its Google Account sync.
Old phone gone: second signed-in device, recovery codes, Authy's 24-hour account recovery, or each service's own recovery, in that order.
Pick a new app that can export, like 2FAS or Aegis, and turn its backup on the day you install it.
Skip every unofficial extraction tool. Delete the old app only after every account passes a sign-in test in the new app.

Where these steps come from

Every settings path and policy claim in this guide was checked against the official help pages below in November 2026. Apps change. If a name on your screen differs slightly, the setting is usually in the same screen under a near-identical name.