How do I back up Google Authenticator?

Question

I'm starting to use Google Authenticator for more and more things now, but I've just realized that if I lose my phone, or if I need to wipe and restore it to install new firmware, I will lose all of my codes.

Is there anyway to back them up please? Or some kind of fallback that means I can restore it to a new device?

Answer 1

You don't need to back up the Google Authenticator app/data as you can create a list of 'Backup codes' which you can use to log in without requiring a authentication code on the same page that you configure 2-step authentication.

Why print or download backup codes?

Backup codes are especially useful for people who travel, have problems receiving SMS or voice calls, or cannot use the Google Authenticator mobile app.

Recommendation: You should print or download backup codes

Store these in a safe place (or print them out) and if you lose your phone you can use one of these codes to log into your account and set up a new device with the Authenticator app.

Whilst this applies to Google's 2-step-authentication, any other sites you have configured to use the Google Authenticator app should offer a similar option, or another way to receive codes (e.g. Facebook supports Google Authenticator, their own app and sms as methods to receive codes).

Answer 2

The following method will only work rooted Android devices.

Linux:

adb pull /data/data/com.google.android.apps.authenticator2/databases/databases /AFolderOnPC

Windows:

adb pull /data/data/com.google.android.apps.authenticator2/databases/databases C:\AFolderOnPC

Note that the folder on the PC has to already exist.

This will copy the authenticator database files with the main keys, from which the One Time Passwords are generated, to the PC. The file can then be restored to the same location, on Android devices, or read with an sqlite database viewer to extract the keys.

Answer 3

It turns out that original tokens (usually represented to the user as QR codes) are stored in the SQLite database inside the /data/data/com.google.android.apps.authenticator2/databases folder and can be extracted from the device.

I automated and explained the recovery process here: https://github.com/dchapkine/extract-google-authenticator-credentials

This project extracts original tokens, then generates a web page with QR codes you can rescan on a new device.

Feel free to contribute.

Answer 4

Titanium Backup (link to Google play store) will backup any android app, including Google Authenticator. However, you must root your phone for this to be a viable option.

I would also recommend printing the Google backup codes too. This isn't quite backing up the Google Authenticator app, but they would allow you to reset the authenticator if necessary. This would only help for regaining access to your Google account though.

Backing up the app with Titanium Backup is the most complete option, in my opinion. It's saved me on a number of occasions.

Answer 5

The easiest way to handle this is to take a screenshot of the QR code whenever you setup a new Authenticator for a site and save it in an encrypted location.

If you need to reinstall or add the Authenticator for that site to another phone, simply add the account in Authenticator by scanning the QR code in the screenshot just as if you were setting up a new site.

Before you negativoids say this won't work, yes it does, and you CAN have the same Authenticator on multiple devices.

Answer 6

Try Authenticator Plus, it supports backup/restore functionality with sync across devices. If you have a phone/tablet, this app syncs all accounts between them flawlessly. It even supports Android wear. It has logos support too.

Answer 7

You can save the QR codes when you setup or renew your 2FA. You can save the QR by making a screenshot. Or using the context menu 'save image as' but this is not always available. (Make sure to give the images a corresponding name with the account and backup in a secure location). For restoration just rescan the QR codes in Google Authenticator.

Answer 8

As a preface this is an approach for configuring MFA ahead of time so that it is always backed up, not recovering or backing up existing codes.

I just went through this process after my Nexus 6P stopped connecting to data and I had to setup all my MFA again on a Pixel. I realized that if I lost my phone or did the factory data reset I'd have been totally borked.

The simplest solution I came up with is to ignore the QR code based setup and just use the token based setup itself (it's the "manual" option in most authenticator apps). Every service I've used so far allows you to opt for the token-based setup rather than QR.

Rather than going through the trouble of taking screen shots of the QR codes, labeling them appropriately and then GPG encrypting them and securely storing them somewhere I just store the tokens in an encrypted vault and setup my MFA manually.

I verified that you can setup clones of the authenticator using the same key on independent devices running simultaneously. Thus, so long as you securely control the tokens, you can configure MFA on any device.

I'm satisfied with this result as I didn't have to do anything more than reconfigure MFA (I had to do this anyway in my circumstances) and simply add all the tokens to lastpass. Now I'm covered in the case of phone loss and can configure other devices if need be.

Answer 9

There are a lot of advice for rooted phones. But it isn't recommended to root your device if you don’t want to make it vulnerable. Two-factor authentication provides an additional layer of protection and by rooting you bring it to naught since different viruses could get an access to protected memory areas.

Only small amount of services offer backup codes (particularly Google). For these services, you should save backup codes.

The best solution is to save the QR codes (or the secret keys) in the moment of token enrollment and keep them in some safe place. Then if you lose your phone you could restore tokens in Google Authenticator on your new device.

Also, you can use hardware tokens. They can be in the form of key fob or credit card. Have a look at this article on the blog of Protectimus (the company where I work) to get more information how to backup Google Authenticator: How to Backup Google Authenticator or Transfer It to a New Phone.

* Disclosure: I work for the website linked above.

Answer 10

Here is a link to simple Python script on my website: http://usefree.com.ua/google-authenticator-backup/

You just paste your code and run them in Python environment.

How it works:

During setting up and configuring two-factor authentication with Google Authenticator, it is possible not only to scan QR-code, but get the code, for example, for Google Mail we get: csnji4rfndisoh323fdsioah3u2iodso. For generating TOTP on your computer with Python IDLE your can define this function:

def totpgen ():
    import time
    import hmac
    import hashlib
    import base64

    ### TOTP-key for Google
    #secret = base64.b32decode("csnji4rfndisoh323fdsioah3u2iodso", True)
    #totp for btc-e
    #secret = base64.b32decode("DHSJHDW89E8DFUS98RIO23J390EFU234IR90WEUIF903DMSKAKDS====")
    ### Calc counter from UNIX time (see RFC6238) 
    counter = long(time.time() / 30)

    ### Use counter as 8 byte array
    bytes=bytearray()
    for i in reversed(range(0, 8)):
      bytes.insert(0, counter & 0xff)
      counter >>= 8

    ### Calculate HMAC-SHA1(secret, counter)
    hs = bytearray(hmac.new(secret, bytes, hashlib.sha1).digest())

    ### Truncate result (see RFC4226)
    n = hs[-1] & 0xF
    result = (hs[n] << 24 | hs[n+1] << 16 | hs[n+2] << 8 | hs[n+3]) & 0x7fffffff

    ### Print last 6 digits
    return str(result)[-6:]

Insert into line

secret = base64.b32decode("csnji4rfndisoh323fdsioah3u2iodso", True)

your code instead of "csnji4rfndisoh323fdsioah3u2iodso"

uncomment line, and call in IDLE

totpgen ()

You will get your TOTP!) For service btc-e try to use line

secret = base64.b32decode("DHSJHDW89E8DFUS98RIO23J390EFU234IR90WEUIF903DMSKAKDS====")

For other services - like described above.

Answer 11

2020.04.23†: Update the app, then go Settings > Transfer Accounts. (then breathe)

Takes me one second to scan QR codes between two phones, took us years to agree it was a feature worth coding even despite it's inherent security risks, meaning be careful, if you can scan in one second then so can someone else.

I believe https://android.stackexchange.com/a/224962/238005† first spotted there is now (after 2020) an official feature/ability to backup/export your list of accounts in a reasonable fashion, which is mentioned inconspicuously at https://support.google.com/accounts/answer/1066447 in the middle of nowhere. Sadly, am I really the first answer with this (official update) in this whole question thread? I fear for our life's data if this idea took this long to think of, and I had to learn through here. Because the option was hidden in a toolbar, and not even a Push Notification for this issue that actually matters.

Answer 12

Originally, when this question was asked, there was no simple solution: people would need to extract the data from an internal sqlite database that wasn't available unless your phone was rooted.

Fortunately, since the first half of 2020, the Google Authenticator app was updated:

WHAT'S NEW

• Added the ability to transfer accounts to a different device, e.g. when switching phones
• Refreshed the look and feel of the app

How you can export the codes from your Google Authenticator

1. Tap on the ⋮ ellipsis at the top right (AKA overflow menu).
2. Tap on Transfer accounts at the menu.
3. Choose Export accounts.
4. Unlock your phone (use the pin, pattern, password, biometrics…). (Sidenote: Your phone has this protection, right? You shouln't leave your phone totally unlocked.)
5. Choose the accounts you wish to export. By default all accounts are already selected.
6. Tap Next. A QR code will be generated.

After exporting the accounts, Google Authenticator app will display a banner at the top: "Accounts were recently exported"

Additionally, it will warn the user with a notification, a few hours later.

Intermission: understanding the QR codes

When a website shows you a QR code for enabling 2FA, the code encodes a URI like this:

otpauth://totp/Example:[email protected]?secret=…&issuer=Example&…

However, when you export the codes from Google Authenticator, the URI in the QR code is different:

otpauth-migration://offline?data=…

“The data parameter is a base64 encoded proto3 message (Google Protocol Buffers).” [citation] That message contains all the exported codes.

However, as you can see, the exported URI is formatted completely differently than the initial URI to setup 2FA. This means many 2FA apps won't be able to scan such QR code, because they won't understand the message.

How to use the exported QR code

Now that you have the QR code, you can use a second device to scan it. You have a few options.

① Import into Google Authentication on another device

At the Transfer accounts screen, choose Import accounts and scan the QR code.

② Import into another 2FA app

Aegis is an open-source 2FA app that allows importing data from multiple apps, and also allows exporting its own data (in an optionally encrypted JSON file). It can even show a standard otpauth-style QR code from any of its codes, making it trivial to export to any other app. It is available on both Google Play and F-Droid.

When using Aegis, just try to scan the QR code normally, as if you were doing a first-time 2FA setup. Aegis has native support for scanning otpauth-migration URIs from Google Authenticator.

There might be other apps with a similar feature, I'm just not aware of any of them.

③ Manually decode and extract the data

You can use a plain QR code scanner to decode the otpauth-migration URI from the QR code. Then you can use scito's tool or digitalduke's tool to extract the secrets and generate the appropriate otpauth URIs that can be imported into any app (after encoding them to QR codes).

References and acknowledgements

• prosody-Gabe Vereable Context's answer showed me the newly-available Transfer accounts feature.
• Related questions:
  • How to migrate accounts to new Google Authenticator app?
  • Can you use a screenshot of the "export accounts" QR Code of Google Authenticator as a backup?
• Authenticator Test for a quick way to generating dummy 2FA codes.
• scrcpy for the screen recording.
  • Google Authenticator blocks screenshots, but I could use scrcpy to record the screen anyway. (Although that seems to be blocked on newer Android versions.)
• ffmpeg and gifski for converting the video into a high-quality GIF, and then GIMP to manually edit the GIF to remove redundant frames and considerably reduce the final file size.

Answer 13

The following method will only work on rooted Android devices. This method is more useful for the not-so tech savvy people or the people like me > who don't want to waste time installing Android SDK + JDK from scratch just to run the adb command.

So here it is:

1. Download and install any "Root explorer" app from Google Play store. I use the popular and free FX file explorer with its free FX root access addon. You can use others too. This app makes it possible for us to access the Android system as a root user.

2. Once you open the file explorer in System root > Click "data" folder > Click "data" folder (inside the other data folder) > Copy the folder named com.google.android.apps.authenticator2 > Exit System root folder > Open normal Main storage / SD storage space and Paste the Folder here.

3. Connect your android device to a PC and Backup the folder to a secure USB / external HDD.

That's it. Now, whenever you need to reinstall your firmware/ buy a new phone just follow the steps above and copy that folder to the exact same directory once you've installed the Google Authenticator app.

OR, you can use a free Open source SQLite GUI editor like "SQLite Database Browser Portable" to open the "databases" file inside the "com.google.android.apps.authenticator2" folder. In the "Browse Data" tab, you can see the key and name corresponding to the key so that you can manually enter the key into the Google Authenticator app.

Answer 14

On a rooted phone, you can use the Amaze File Manager app.

1. Go to the root /data/data/com.google.android.apps.authenticator2/database directory. Open the database file as a database.
2. Select accounts. You will have 3 columns _id, email, and secret.
3. Copy the secret value.
4. When you need to restore just add, select "Enter a provided key", give it a name, and paste in the value.

Answer 15

As I have experienced same just some time before. When you would be signing in to your account you will get page for key to put 6 digit code. At this place you can change second key and get in phone number if you have any number verified already. And for more backup you can choose an other computers as trusted. So, they won't ask second step code on those computers.

Answer 16

Fast forward to April 2023, Google Authenticator now allows the user to sync the entries to their Google Account.

As reported on Google Security Blog - Google Authenticator now supports Google Account synchronization,

We are excited to announce an update to Google Authenticator, across both iOS and Android, which adds the ability to safely backup your one-time codes (also known as one-time passwords or OTPs) to your Google Account.

[...]

One major piece of feedback we’ve heard from users over the years was the complexity in dealing with lost or stolen devices that had Google Authenticator installed. Since one time codes in Authenticator were only stored on a single device, a loss of that device meant that users lost their ability to sign in to any service on which they’d set up 2FA using Authenticator.

With this update we’re rolling out a solution to this problem, making one time codes more durable by storing them safely in users’ Google Account. This change means users are better protected from lockout and that services can rely on users retaining access, increasing both convenience and security.

[...]

To try the new Authenticator with Google Account synchronization, simply update the app and follow the prompts.