Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm starting to use Google Authenticator for more and more things now, but I've just realized that if I lose my phone, or if I need to wipe and restore it to install new firmware, I will lose all of my codes.

Is there anyway to back them up please? Or some kind of fallback that means I can restore it to a new device?


share|improve this question
I don't understand... A code is to be used only once, they aren't stored anywhere on your phone, if you need to enter a code on a site, you have to use a new code, even if you already put one on this site some time ago. – Shywim Feb 11 '14 at 9:08
Thank you, but as I understand it, if I lose my phone now, I won't even be able to login to the site, let alone setup a new Google Authenticator code – Nick Feb 11 '14 at 9:31
If you need a code to log-in while your phone is lost, you can use one of the backup method (SMS, Call, printed codes...). It is highly recommended to setup at least one of these alternative method to overcome this kind of situation :) – Shywim Feb 11 '14 at 10:09
I've always wanted to fork Google Authenticator to add this feature. I'm hoping somebody will do it before I have the time. – Michael Kropat Feb 11 '14 at 15:27

10 Answers 10

The following method will only work rooted Android devices.


adb pull /data/data/ /AFolderOnPC


adb pull /data/data/ C:\AFolderOnPC

Note that the folder on the PC has to already exist.

This will copy the authenticator database files with the main keys, from which the One Time Passwords are generated, to the PC. The file can then be restored to the same location, on Android devices, or read with an sqlite database viewer to extract the keys.

share|improve this answer
+1 for actually answering the question. – Jonah Nov 17 '14 at 19:17
When copying to a new device, make sure the databases folder and databases file both have 755 permissions. I tried 700, and GA kept crashing. Kind of concerning that it requires full permissions. Maybe that's NSA's requirement. – eduncan911 Jun 22 '15 at 23:40

You don't need to back up the Google Authenticator app/data as you can create a list of 'Backup codes' which you can use to log in without requiring a authentication code on the same page that you configure 2-step authentication.

Why print or download backup codes?

Backup codes are especially useful for people who travel, have problems receiving SMS or voice calls, or cannot use the Google Authenticator mobile app.

Recommendation: You should print or download backup codes

Store these in a safe place (or print them out) and if you lose your phone you can use one of these codes to log into your account and set up a new device with the Authenticator app.

Whilst this applies to Google's 2-step-authentication, any other sites you have configured to use the Google Authenticator app should offer a similar option, or another way to receive codes (e.g. Facebook supports Google Authenticator, their own app and sms as methods to receive codes).

share|improve this answer
Many thanks, so effectively I could create my own backups then, by saving a copy of the QR code used to setup Google Authenticator for each site too? – Nick Feb 11 '14 at 10:12
I don't know... I expect that they are time/use limited so wouldn't work more than once or after a period of time. – bmdixon Feb 11 '14 at 10:16
For the sites that don't offer it then i'd say that your only option is to use a strong unique password without 2 step authentication. Out of interest, what sites don't offer a backup option? Dropbox, Facebook, LastPass, Wordpress all do (those are the other sites I use 2 step authentication with). – bmdixon Feb 11 '14 at 11:38
@Nick: Saving the QR code that Google or other sites provide and adding them back into Authenticator on another device does work. I have done this a few times myself. However you should make sure that the time is correct and up to date constantly on both devices (if you intend on keeping using both of them) otherwise authentication might fail. – Andris Feb 11 '14 at 12:57
The two-factor authentication "one-time" password is generated with two things: the current time, and a secret shared between the server and the app during the initialization. In your case, the secret is the QR code. As long as another instance of the authenticator app shares the same secret and the same time (the same 30s frame), both apps will generate the same passwords. – Kernald Feb 11 '14 at 15:55

Try Authenticator Plus, it supports backup/restore functionality with sync across devices, if you have a phone/tablet, this app syncs all accounts between them flawlessly, it even support Android wear.

It has logos support too Authenticator Plus Screenshot

share|improve this answer
Or you could use Authy (, which is free. – lid Jul 26 '14 at 1:56
Authy looks awesome! Much better than google's, except it's not opensource. I can live with it. – cregox Nov 29 '14 at 18:58
Doesn't this sound like a bad idea? The whole point of the Time-based One-time pad protocol (TOTP aka rfc6238, which is what authy/google authenticator, et al implement) is that you and only you have the ability to generate the codes. If you let some 3rd party store those codes, they become a huge target for attacks, nevermind having to trust everybody that works for this service and how they've implmented it. – antiduh Apr 28 '15 at 18:19
@antiduh of-course its matter of security vs usability, if you are more concerned with security its not ideal for you and you should actually move away from software solutions and use hardware solutions like yubikey – Riyaz Mohammed Ibrahim May 7 '15 at 6:07

Titanium Backup (link to Google play store) will backup any android app, including Google Authenticator. However, you must root your phone for this to be a viable option.

I would also recommend printing the Google backup codes too. This isn't quite backing up the Google Authenticator app, but they would allow you to reset the authenticator if necessary. This would only help for regaining access to your Google account though.

Backing up the app with Titanium Backup is the most complete option, in my opinion. It's saved me on a number of occasions.

share|improve this answer

I had the exact same problem.

It turns out that original tokens (usualy represented to the user as qrcodes) are stored in sqlite database inside /data/data/ folder and can be extracted from the device.

I automated and explained the recovery process here:

This project extracts original tokens, then generates a web page with qrcodes you can rescan on a new device.

Feel free to contribute.

share|improve this answer
This just saved me logging into all of my 2FA accounts and switching the phone manually. Many thanks! – Kovah Jun 21 at 5:41

The following method will only work on rooted Android devices. This method is more useful for the not-so tech savvy people or the people like me > who don't want to waste time installing Android SDK + JDK from scratch just to run the adb command.

So here it is:

  1. Download and install any "Root explorer" app from Google Play store. I use the popular and free FX file explorer with its free FX root access addon. You can use others too. This app makes it possible for us to access the Android system as a root user.

  2. Once you open the file explorer in System root > Click "data" folder > Click "data" folder (inside the other data folder) > Copy the folder named > Exit System root folder > Open normal Main storage / SD storage space and Paste the Folder here.

  3. Connect your android device to a PC and Backup the folder to a secure USB / external HDD.

That's it. Now, whenever you need to reinstall your firmware/ buy a new phone just follow the steps above and copy that folder to the exact same directory once you've installed the Google Authenticator app.

OR, you can use a free Open source SQLite GUI editor like "SQLite Database Browser Portable" to open the "databases" file inside the "" folder. In the "Browse Data" tab, you can see the key and name corresponding to the key so that you can manually enter the key into the Google Authenticator app.

share|improve this answer
@Izzy Edited out the subjective part and thanks for the help :) The method just looks big but is the most time saving for normal people who wouldn't be android devs. I actually looked at this thread before finding out a solution on my own. Backup codes - not available for most services (only works on google). Authenticator Plus is a paid app. Titanium backup can have compatibility issues. ADB pull command needs you to install Android SDK+JDK. My method is as "easy" as copy-pasting a folder. – Pavin Joseph Dec 31 '14 at 9:45
Thanks for the edit, Pavin! On your comment, I've got to partly disagree: I've never ever installed the SDK+JDK, but still use a bunch of ADB features (especially with my own tool "Adebar" for device documentation, backup/restore scripts and more). On Linux, I just need the adb executable for that (on Windows, two .dll files are required additionally). For details, see Is there a minimal installation of ADB? – Izzy Dec 31 '14 at 12:11
PS: Have there ever been any permission issues? Copying the data directory of an app manually to another device might bring up such. Remember, to correctly access files the permissions and ownership must match. On installation, each app is assigned a unique UID/GID pair. File permissions have flags for owner/group/others. Usually, app data has at max -rw-rw-- (owner and group read/write, others nothing). So if there's a mismatch in ownership, you might be in trouble (and the app might misbehave). – Izzy Dec 31 '14 at 12:17
Yeah, it works most of the time. But if it doesn't you can use any SQLite editor to open and view the secret key from the databases file; then proceed to add the account in Google Authenticator using the key. – Pavin Joseph Dec 31 '14 at 18:36
Ah. Better solution: If it does not work, check and adjust permissions. Before overwriting /data/data/, do an ls -l on it and check ownership/permissions. After copying, use chown and chmod to fix it back. – Izzy Dec 31 '14 at 20:21

You can save the QR codes when you setup or renew your 2FA. You can save the QR by making a screenshot. Or using the context menu 'save image as' but this is not always available. (Make sure to give the images a corresponding name with the account and backup in a secure location). For restoration just rescan the QR codes in Google Authenticator.

share|improve this answer

Here is simple Python script:

You paste your code in and run them in Python environment.

How it's work.

During setting up and configuring two-factor authentication with Google authenticator it is possiple not only to scan QR-code, but get the code, for example, for google mail we get : csnji4rfndisoh323fdsioah3u2iodso. For generating TOTP on your computer with Python IDLE your can define function:

def totpgen ():
    import time
    import hmac
    import hashlib
    import base64

    ### TOTP-key for Google
    #secret = base64.b32decode("csnji4rfndisoh323fdsioah3u2iodso", True)
    #totp for btc-e
    #secret = base64.b32decode("DHSJHDW89E8DFUS98RIO23J390EFU234IR90WEUIF903DMSKAKDS====")
    ### Calc counter from UNIX time (see RFC6238) 
    counter = long(time.time() / 30)

    ### Use counter as 8 byte array
    for i in reversed(range(0, 8)):
      bytes.insert(0, counter & 0xff)
      counter >>= 8

    ### Calculate HMAC-SHA1(secret, counter)
    hs = bytearray(, bytes, hashlib.sha1).digest())

    ### Truncate result (see RFC4226)
    n = hs[-1] & 0xF
    result = (hs[n] << 24 | hs[n+1] << 16 | hs[n+2] << 8 | hs[n+3]) & 0x7fffffff

    ### Print last 6 digits
    return str(result)[-6:]

Insert into line

secret = base64.b32decode("csnji4rfndisoh323fdsioah3u2iodso", True)

your code instead of "csnji4rfndisoh323fdsioah3u2iodso"

uncomment line, and call in IDLE

totpgen ()

You will get your TOTP!) For service btc-e try to use line

secret = base64.b32decode("DHSJHDW89E8DFUS98RIO23J390EFU234IR90WEUIF903DMSKAKDS====")

For other services - like described above.

share|improve this answer
Could you include the relevant code and explain how to use it? (e.g. what does this code do? Paste "what" code & from where? Not everybody understands Russian). Link-only answer is discouraged, since if the link rots, then there is nothing useful left. (Also, disclosure is needed if you intend to promote your blog. Otherwise, it might be assumed as purely promotional aka spam). – Andrew T. Apr 14 '15 at 1:21

As I have experienced same just some time before. When you would be signing in to your account you will get page for key to put 6 digit code. At this place you can change second key and get in phone number if you have any number verified already. And for more backup you can choose an other computers as trusted. So, they won't ask second step code on those computers.

share|improve this answer

The easiest way to handle this is to take a screenshot of the QR code whenever you setup a new Authenticator for a site and save it in an encrypted location.

If you need to reinstall or add the Authenticator for that site to another phone, simply add the account in Authenticator by scanning the QR code in the screenshot just as if you were setting up a new site.

Before you negativoids say this won't work, yes it does, and you CAN have the same Authenticator on multiple devices.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.