Guides

Move from Google Authenticator

Import all your Google Authenticator accounts into 2FA Keyring at once using its export QR codes. The codes are decoded on your device and never uploaded.

About 10 minutes · You'll need your phone and a way to get pictures of its screen

How it works

Google Authenticator can export your accounts as one or more QR codes. Each code contains the accounts' setup keys in a format starting with otpauth-migration://. 2FA Keyring reads that format directly, shows you every account it found, and saves nothing until you confirm.

Treat export codes like passwords

Anyone who sees an export QR code can copy every account in it. Take pictures privately, don't send them through chat or email, and delete them once you're done.

1. Export from Google Authenticator

  1. On your phone, open Google Authenticator.
  2. Open the menu and choose Transfer accounts, then Export accounts. You may be asked to confirm it's you.
  3. Select the accounts to move and continue. The app shows one QR code, or several if you have many accounts (for example "1 of 3").

Menu names can differ between app versions. If yours looks different, follow Google's own instructions.

2. Get pictures of the codes

2FA Keyring reads QR codes from images, so you need a picture of each export code:

  • Using 2FA Keyring on a computer: take a photo of the phone screen with another phone or camera, then move the photos to the computer privately (for example with a cable).
  • Using 2FA Keyring on a second phone: in the import screen, the picture button usually lets you take a photo directly.
  • Screenshots: some phones don't allow screenshots of the export screen. If a screenshot comes out blank, take a photo instead.

For a multi-code export, get a picture of every code. Keep the pictures sharp and close: the code should fill most of the frame.

3. Import and review

  1. Open your vault and choose Add key, then the Google Authenticator tab.
  2. Choose all the pictures at once. If you have the export as text instead, open Paste an export link instead.
  3. Review the list. Each account is marked:
    • Ready: it will be imported.
    • Already in your vault: skipped, so nothing is added twice.
    • Appears twice in this export: only one copy is imported.
    • Not supported: counter-based (HOTP) and MD5 codes aren't supported. They're listed but never imported or converted.
  4. If the app says some export codes haven't been read, choose Scan more codes and add the missing pictures. You can also import what you have now and add the rest later.
  5. Untick anything you don't want, then choose Import.

If you'd like to practise first, the same import works in the demo, where nothing is saved.

4. Check before removing anything

  1. For each imported account, compare the code in 2FA Keyring with the code in Google Authenticator. They should match at the same moment.
  2. Better still, sign in to each service once using a code from 2FA Keyring.
  3. Make a backup of your vault and check that it opens. See the backup guide.
  4. Only then remove the accounts from Google Authenticator, if you want to. Delete the export pictures.

If something goes wrong

  • "No QR code found": retake the picture closer, in good light, with the whole code in frame and no glare.
  • "Incomplete or damaged": the picture was read but the data was cut off. Export again and retake the picture.
  • "Isn't a Google Authenticator export": that QR code is for a single account. Use the Links or QR images tab instead.
  • Codes don't match: make sure your device's clock is set automatically, then compare again.