Moving Google Authenticator to a new phone without losing your codes

For most of its first decade, Google Authenticator had a feature list you could print on a stamp. It generated codes. It kept the secrets behind those codes welded to a single phone. No export, no backup, no sync — the app millions chose precisely because it was simple and everywhere became one of the most common ways those same people locked themselves out of their own accounts. New phone day meant a race: re-enroll everything before the old handset died, or start collecting "contact support" forms.

It is better now, in scattered and incomplete ways. The app learned to move accounts between devices in May 2020, when version 5.10 added import and export. It learned to sync to your Google account in April 2023. And some accounts still refuse to move at all. Here is the honest map for a Google Authenticator transfer to a new phone in 2026 — what works, what to distrust, and what to do when nothing cooperates.

What you are actually moving

An authenticator app is a box of seeds. Each account you enroll hands the app a shared secret — a short Base32 string, shown once as a QR code — and from then on, both sides derive the same six-digit code from that seed and the current time. The codes are disposable. The seeds are permanent: anyone holding a seed generates its codes forever, on any device. Every method below is answering one question — where do the seeds go when the phone they live on retires. The offline, local nature of that math is covered in Using TOTP offline, and it matters here: nothing in a transfer needs the internet except your patience.

Path 1: Transfer accounts — the old phone shows a QR, the new one scans it

The built-in transfer is the closest thing to a one-tap migration, and it has existed since the 2020 update:

1. On the old phone, open Google Authenticator, tap the menu at the top right — the three dots on Android — and choose Transfer accounts.
2. Tap Export accounts, tick everything you want to move, and tap Next.
3. The old phone displays a QR code. The app exports up to ten accounts per pass, so a crowded authenticator produces several codes in sequence.
4. On the new phone, open Google Authenticator, choose Import accounts from the same menu, and scan each code as it appears.

The exchange is offline — camera to screen, no network involved — and it crosses platforms, Android to iPhone and back. One caveat surprises people: exporting is copying. The old phone keeps every seed and keeps generating valid codes. That is convenient during the move and a liability after it — once the new phone is verified, retire the old one deliberately instead of leaving a second live authenticator in a drawer.

Path 2: Export accounts — a QR you keep

The same menu also treats Export accounts as an end in itself, and this is the one that doubles as a Google Authenticator backup. The export QR encodes every selected seed into a single migration payload — not a picture of your list, but the secrets themselves, machine-readable. Third-party tools can parse it: other authenticator apps import it during setup, and the guest generator at 2FA by DependsiT reads a Google Authenticator export and shows your codes instantly, computed entirely in the page with zero network requests and nothing stored.

That also makes the export QR the most dangerous image your phone has ever displayed. Treat it accordingly — the hygiene rules are below, and they are short. Saved properly, an export is the difference between a lost phone being an errand and being an incident.

Path 3: Cloud sync — convenient, with an asterisk

On April 24, 2023, Google announced that Authenticator would back up one-time codes to your Google account, on both Android and iOS, so a new phone signed into the same account repopulates itself. Google Authenticator new phone day becomes a sign-in rather than a project — no old handset required, no QR codes, nothing left in an old apartment.

The asterisk is what syncs and how. What syncs is the seeds themselves, stored in your Google account. How, at launch, was the problem: the synced data was not end-to-end encrypted. Researchers who examined the sync traffic found the secrets readable on Google's side of the exchange — Petri reported the findings, and Android Central warned users against enabling sync while the gap stood. A second factor that a compromised Google account, or a legal demand served on Google, could expose is a weaker object than the phone-only original. Google's response was that end-to-end encryption was on the roadmap — and months later, watchers were still waiting for it to appear.

Then the choice quietly stopped being one. Sync arrived in April 2023 as an opt-in, but it did not stay that way — by the 2024 redesign, which added a privacy screen and search while treating account sync as standard equipment, criticism had settled on a specific complaint: seeds were being uploaded to Google's servers by default, without an opt-in warning that secrets were leaving the device at all. The honest position in 2026 is two sentences. Sync is genuinely convenient — a dead phone costs you nothing. And if you leave it on, the Google account holding those seeds had better have serious 2FA of its own, so start with the Gmail 2FA setup guide: your authenticator seeds are now exactly as strong as the account backing them. The app's settings screen holds the sync switch if you decide the trade is not for you.

Path 4: Re-enroll the stubborn ones

A few of your accounts will simply be missing from the export list. Some banks, brokerages, and workplace systems deliberately mark their seeds non-exportable — the reasoning is that a seed that can be copied is a seed that can be leaked, so the only copies are the ones they know about. From inside the transfer menu there is nothing to do about this. The way out is old-fashioned: while the old phone still generates codes, visit each stubborn service, disable its 2FA, re-enable it, and enroll the new device. Tedious, but it is the one method that always works, because it does not depend on the seed moving at all. When you re-enroll, you are also free to pick something more portable — Google Authenticator alternatives compares the realistic options.

The export QR is the secret — act like it

The codes rotate every 30 seconds. The seed never rotates. A photograph of your export screen, a screenshot saved to a gallery that syncs itself to cloud photos, a QR image emailed to yourself as a "backup" — each of these hands every account in the export to whoever reads that storage later, permanently. The rules are short:

• Export in private, screen away from cameras and shoulders.
• If you keep the QR or the payload behind it, store it encrypted — or print the secrets on paper and put that paper in a safe, which remains the most durable backup medium there is.
• Never move an export through email, chat, or a cloud note.
• Wipe the old phone once the new one is verified, and stop there.

Where a zero-knowledge vault makes migration a non-event

Every path above is a variation on the same anxiety: where do the seeds live between devices. A zero-knowledge vault answers it structurally. In 2FA by DependsiT's vault, entries are encrypted on your device before upload — PBKDF2 salted derivation, HKDF key separation, AES-256-GCM, with Argon2id protecting login — and the server holds only ciphertext it cannot decrypt. New phone, new laptop, borrowed machine: sign in, type your password, your keys re-derive locally, and the entries decrypt in place. Migration stops being an event at all. The app installs as a PWA on iPhone, Android, Windows, and Mac, works fully offline after first load, and handles TOTP, HOTP, and Steam Guard with per-key algorithm, digits, period, and counter. For the broader question of where your seeds should live, the best TOTP apps of 2026 comparison is the round-up.

Frequently asked questions

Does transferring delete the codes from my old phone?

No. Export and transfer are copy operations — the old phone keeps every seed and keeps generating valid codes indefinitely. That is useful mid-migration, when you want both devices working while you verify the new one, and a quiet liability afterward. Once the new phone produces matching codes for every account, retire the old one deliberately: remove it from any trusted-device lists, factory-reset the handset before selling or recycling it, and treat any drawer phone with live seeds as the key ring it is.

Can I transfer from Android to iPhone, or the other way?

Yes. The export QR is platform-blind — it encodes the seeds, not the app — so an Android phone can display it for an iPhone to scan and vice versa. Both devices need the Google Authenticator app installed and both need cameras, and that is the full requirements list. The transfer happens over the air only in the sense that light travels between the screens — no network, no account, no cable. The app exports up to ten accounts per pass, so a long list takes several rounds of show-and-scan.

What if the old phone is already lost or dead?

Then it depends entirely on what you set up before. If cloud sync was on, a fresh install signed into your Google account repopulates itself — that is the scenario sync exists for, and its one unambiguous win. If sync was off and you kept no export, the seeds died with the phone, and each affected account needs its own recovery: backup codes printed at enrollment, the service's account-recovery process, or a support ticket. This is why the export question matters before new phone day, not after it.

Why are some accounts missing from the export list?

Because the service that issued the seed marked it non-exportable. Banks, brokerages, and enterprise systems do this deliberately: a seed that cannot be copied cannot walk out as a side effect of copying everything else. From your side it looks like a gap in the list, and no export method will fill it — the app cannot hand over what it agreed to hold in place. The fix is unglamorous and always available: disable 2FA on that service and re-enroll it fresh on the new device, while the old one still works.

Should I leave Google Authenticator's cloud sync on?

It depends on which failure you fear more. Sync means a dead phone costs you nothing — sign in on the replacement and the codes return, which is a real improvement over the lockout era. It also means your seeds live in your Google account, which concentrates risk: the sync launched without end-to-end encryption, and the defaults since have leaned toward on rather than asking. If you keep sync on, harden the Google account itself. If you turn it off, replace it with something — an encrypted export, a zero-knowledge vault, or paper in a safe.

However you make the move, make it while the old phone still boots. And if you want to see what is actually inside that export QR before you trust any app with it, the guest generator takes a Google Authenticator export, shows the codes instantly, and forgets everything when you reload.