New phone and authenticator app: how to transfer your codes

Why can codes get lost when you change phones?

An authenticator app generates one-time codes for signing in. Germany's Federal Office for Information Security (BSI) describes these apps as software that keeps generating new one-time passwords, based on time or on events. To do this, the app stores a secret for each account that the service also knows.

Where that secret is kept depends on the app and its settings. Google Authenticator, for example, keeps codes only on the device if you use it without a Google Account. Other devices, including your new phone, will not have them.

According to the BSI, if your second factor is missing or broken, you will usually lose access to the service. It therefore recommends registering several second factors where possible. Changing phones is a good moment to do so. For a comparison of the options, see SMS, app or passkey: which extra account protection suits you?.

What should you sort out before transferring anything?

As long as the old phone works, every option is still open. So prepare first:

1. Open the authenticator app on the old phone and write down which accounts it generates codes for. The names are enough; you do not need the codes themselves.
2. Check the app's settings to see whether it uses a backup or sync, and with which account.
3. Find the recovery codes for your most important accounts. The BSI advises checking how a service's recovery mechanism works, for example by storing backup codes.
4. Make sure the phone number and email address used for account recovery are still correct.
5. Charge the old phone and keep it within reach until everything is done.

For tips on storing those codes so you can actually find them in an emergency, see Storing recovery codes safely and finding them again.

Which transfer method suits your app?

You can combine these methods. If one account does not come across with a backup, you set up just that one again.

How do you move Google Authenticator and Microsoft Authenticator?

Google Authenticator

If you use Google Authenticator with your Google Account, Google says your codes are synced. When you sign in with the same account on the new phone, they appear there automatically. Google states that it encrypts Authenticator codes in transit and at rest, and lists syncing as a best practice.

If you tapped ‘Use without an account’ when you first opened the app, the codes are only on the old phone. In that case, you move them from phone to phone with a QR code.

Microsoft Authenticator

Microsoft Authenticator restores accounts from a cloud backup. According to Microsoft, this only works on the same device type: accounts backed up on an iPhone cannot be restored on an Android phone. On an iPhone, the backup depends on three iCloud features, which also need to be on on the new device.

After restoring, Microsoft says codes for third-party accounts such as Amazon or Gmail are available again. For work or school accounts, only the account name is restored, so you need to sign in again.

What about accounts without a backup?

Not every app can transfer codes, and not every account comes across. In that case, set up sign-in again with the service itself while the old phone still generates codes.

1. Sign in to the service and confirm with a code from the old phone.
2. Open the account's security settings and add the authenticator app on the new phone. Follow the service's instructions.
3. Confirm the setup with a code from the new phone.
4. Only then remove the old device from the account.

Austria's Federal Ministry of Finance describes this order for its FinanzOnline tax portal: register the new device first, then remove the old one. Doing it the other way round may leave you without a valid second factor for a while.

Public authorities, banks and employers sometimes use their own apps or procedures. Read their guidance on changing devices before you switch, and allow time for a new activation if needed.

When is it safe to reset the old phone?

Only once you have signed in to every account on your list with a code from the new phone. It is fine to keep the old device for a few more days in case a rarely used account turns up that you missed.

Be careful with synced codes: if you delete a code in Google Authenticator that is synced with your Google Account, Google says it is deleted from all devices. So do not remove individual entries on the old phone. Reset the whole device instead, as described in Passing on an old phone: back up first, then sign out properly.

If the old phone is lost or stolen, Google says to make sure at once that nobody can reach the codes stored on it: erase it remotely, remove it from your Google Account if the codes were synced, or otherwise remove the codes at each service. More in Lost phone: lock it, use fallback options and sort out contacts.

Where can you get guidance in your country?

The steps for moving the app come from the app makers and do not depend on where you live. National authorities do publish advice on two-factor sign-in, though, and some public services have their own rules.

An example: Siobhán moves her codes

Fictional example: Siobhán from Cork is getting a new phone. She uses her authenticator app without an account, so the codes are only on the old device. First she writes the eight account names from the app on a sheet of paper and looks for her recovery codes. For her email account she finds none, so she creates new ones.

She then exports the accounts by QR code, scans them with the new phone and tests every account with a fresh code. Seven work straight away; she had missed one rarely used account during the export. Because the old phone still works, she sorts that out in a few minutes. She only resets the old device after a week without problems.