157

I'm starting to use Google Authenticator for more and more things now, but I've just realized that if I lose my phone, or if I need to wipe and restore it to install new firmware, I will lose all of my codes.

Is there anyway to back them up please? Or some kind of fallback that means I can restore it to a new device?

6
  • 5
    If you need a code to log-in while your phone is lost, you can use one of the backup method (SMS, Call, printed codes...). It is highly recommended to setup at least one of these alternative method to overcome this kind of situation :) Feb 11, 2014 at 10:09
  • 3
    I've always wanted to fork Google Authenticator to add this feature. I'm hoping somebody will do it before I have the time. Feb 11, 2014 at 15:27
  • This kind of half-assed security thinking is why every company in the United States has been broken into in the past five years. For every security measure, there is someone who wants to break those measures to make them "easier to use." Those authenticator codes are designed to be hard to copy. If you lose your phone, you lose your codes, and you of course go to your backup authentication scheme that you've carefully put into place to regenerate those codes.
    – johnwbyrd
    Oct 2, 2017 at 8:10
  • Am I confused or are you guys, The point of the Authenticator is that it generates dynamic codes that change, about once a minute. What's the point of backing them up? Dec 29, 2022 at 4:22
  • @RohitGupta we’re talking about the codes used to generate those codes :)
    – Nick
    Dec 30, 2022 at 9:42

16 Answers 16

30

You don't need to back up the Google Authenticator app/data as you can create a list of 'Backup codes' which you can use to log in without requiring a authentication code on the same page that you configure 2-step authentication.

Why print or download backup codes?

Backup codes are especially useful for people who travel, have problems receiving SMS or voice calls, or cannot use the Google Authenticator mobile app.

Recommendation: You should print or download backup codes

Store these in a safe place (or print them out) and if you lose your phone you can use one of these codes to log into your account and set up a new device with the Authenticator app.

Whilst this applies to Google's 2-step-authentication, any other sites you have configured to use the Google Authenticator app should offer a similar option, or another way to receive codes (e.g. Facebook supports Google Authenticator, their own app and sms as methods to receive codes).

13
  • 4
    For the sites that don't offer it then i'd say that your only option is to use a strong unique password without 2 step authentication. Out of interest, what sites don't offer a backup option? Dropbox, Facebook, LastPass, Wordpress all do (those are the other sites I use 2 step authentication with).
    – bmdixon
    Feb 11, 2014 at 11:38
  • 20
    @Nick: Saving the QR code that Google or other sites provide and adding them back into Authenticator on another device does work. I have done this a few times myself. However you should make sure that the time is correct and up to date constantly on both devices (if you intend on keeping using both of them) otherwise authentication might fail.
    – Andris
    Feb 11, 2014 at 12:57
  • 8
    The two-factor authentication "one-time" password is generated with two things: the current time, and a secret shared between the server and the app during the initialization. In your case, the secret is the QR code. As long as another instance of the authenticator app shares the same secret and the same time (the same 30s frame), both apps will generate the same passwords. Feb 11, 2014 at 15:55
  • 2
    You might still want to back it up when you are going to reset your phone, so you don't have to spend an hour going to every site you use authenticator for, entering a backup code and resetting the authenticator setup. Aug 7, 2014 at 8:22
  • 8
    This is only true for Google's 2-step authentication. Google authenticator works with many other sites, and some don't have a way to create a list of backup codes. Some use SMS, some give you a single one-time-use backup code, and some don't have any backup option at all. Even when every site has a backup option, having to restore all of the many keys when getting a new phone is a huge hassle. Jun 13, 2017 at 16:56
92

The following method will only work rooted Android devices.

Linux:

adb pull /data/data/com.google.android.apps.authenticator2/databases/databases /AFolderOnPC

Windows:

adb pull /data/data/com.google.android.apps.authenticator2/databases/databases C:\AFolderOnPC

Note that the folder on the PC has to already exist.

This will copy the authenticator database files with the main keys, from which the One Time Passwords are generated, to the PC. The file can then be restored to the same location, on Android devices, or read with an sqlite database viewer to extract the keys.

6
  • 10
    When copying to a new device, make sure the databases folder and databases file both have 755 permissions. I tried 700, and GA kept crashing. Kind of concerning that it requires full permissions. Maybe that's NSA's requirement.
    – eduncan911
    Jun 22, 2015 at 23:40
  • 13
    You need to adb root before you do this, or you will get remote object '/data/data/com.google.android.apps.authenticator2/databases' does not exist Sep 15, 2016 at 2:27
  • 4
    Note that if you have SELinux enabled, even with the correct permission bits the Authenticator app can crash. To fix this, run restorecon -F /data/data/com.google.android.apps.authenticator2/databases/databases after you put back the database file. (source)
    – Hai Zhang
    Jul 24, 2017 at 7:13
  • @eduncan911 660 works for me
    – deed02392
    Nov 20, 2017 at 22:08
  • Rooting your device makes it less secure. If you're using 2FA then presumably you want more security. For the risks: owasp.org/index.php/Projects/… Dec 5, 2017 at 17:36
27

It turns out that original tokens (usually represented to the user as QR codes) are stored in the SQLite database inside the /data/data/com.google.android.apps.authenticator2/databases folder and can be extracted from the device.

I automated and explained the recovery process here: https://github.com/dchapkine/extract-google-authenticator-credentials

This project extracts original tokens, then generates a web page with QR codes you can rescan on a new device.

Feel free to contribute.

8
  • 1
    This just saved me logging into all of my 2FA accounts and switching the phone manually. Many thanks!
    – Kevin
    Jun 21, 2016 at 5:41
  • This is exactly what I was looking for. A quick and easy way to re-scan all of the QR codes.
    – Harvey
    Nov 27, 2017 at 18:08
  • 1
    Thanks for this but my device is not rooted. Do I understand correctly that I have a "Catch 22" situation on my hand where rooting my device will wipe it clean?
    – urig
    Dec 28, 2017 at 20:07
  • 1
    @urig, no, rooting of some phones won't necessarily wipe apps data. Feb 1, 2018 at 21:47
  • 3
    @dchapkine For devices with no root method available, is there any other method to access the .db? Like with SetEdit with elevated permissions via ADB? Or (assuming the allow_backup flag is enabled through manifest), any way to take an ADB backup and decompress manually (no data encryption configured)? I'm on an SM-N950UZKATMB stock, Android 9
    – Arctiic
    Apr 27, 2020 at 21:30
23

Titanium Backup (link to Google play store) will backup any android app, including Google Authenticator. However, you must root your phone for this to be a viable option.

I would also recommend printing the Google backup codes too. This isn't quite backing up the Google Authenticator app, but they would allow you to reset the authenticator if necessary. This would only help for regaining access to your Google account though.

Backing up the app with Titanium Backup is the most complete option, in my opinion. It's saved me on a number of occasions.

3
  • Had to settle for this because I couldn't adb pull the databases directory, couldn't copy to /sdcard and take it - chmod 777 did nothing. Aug 30, 2017 at 9:39
  • "Import from Google Authenticator" -- Sold! Very important migration feature.
    – Adambean
    Aug 31, 2017 at 7:18
  • Worth mentioning, in order not to re-root the new phone. After backup click on the backup/restore tab -> choose Authenticator app -> slide right for special features tab -> choose Explore -> choose accounts under [DATABASE]. then you'll get all the account in your app in a .csv file. use the secret column to restore the accounts to the new phone.
    – Yan
    Jan 21, 2019 at 10:44
21

The easiest way to handle this is to take a screenshot of the QR code whenever you setup a new Authenticator for a site and save it in an encrypted location.

If you need to reinstall or add the Authenticator for that site to another phone, simply add the account in Authenticator by scanning the QR code in the screenshot just as if you were setting up a new site.

Before you negativoids say this won't work, yes it does, and you CAN have the same Authenticator on multiple devices.

2
  • 3
    I would like to explain why this works, both the website and your device will share a simple string of characters, "the code", set in the QR code, and they will endlessly use it to create new 6 digit codes from, based on the current date and time. Therefore, you only need to have this code to generate new codes. The website has no way of checking who or what created the 6 digit code, it only needs to be correct.
    – Arie
    Aug 3, 2017 at 14:18
  • better idea: just use a better OTP app. Some do allow exporting secrets.
    – jiggunjer
    Dec 3, 2019 at 10:59
16

Try Authenticator Plus, it supports backup/restore functionality with sync across devices. If you have a phone/tablet, this app syncs all accounts between them flawlessly. It even supports Android wear. It has logos support too.

5
  • 14
    Or you could use Authy (authy.com), which is free.
    – lid
    Jul 26, 2014 at 1:56
  • 6
    Authy looks awesome! Much better than google's, except it's not opensource. I can live with it.
    – cregox
    Nov 29, 2014 at 18:58
  • 20
    Doesn't this sound like a bad idea? The whole point of the Time-based One-time pad protocol (TOTP aka rfc6238, which is what authy/google authenticator, et al implement) is that you and only you have the ability to generate the codes. If you let some 3rd party store those codes, they become a huge target for attacks, nevermind having to trust everybody that works for this service and how they've implmented it.
    – antiduh
    Apr 28, 2015 at 18:19
  • 2
    @antiduh of-course its matter of security vs usability, if you are more concerned with security its not ideal for you and you should actually move away from software solutions and use hardware solutions like yubikey May 7, 2015 at 6:07
  • 1
    Or you could use an open-source alternative that has the ability to import and export the codes: getaegis.app github.com/beemdevelopment/Aegis — Regardless, this answer doesn't answer the question, so I'm afraid I'm downvoting it. Dec 7, 2021 at 8:51
9

You can save the QR codes when you setup or renew your 2FA. You can save the QR by making a screenshot. Or using the context menu 'save image as' but this is not always available. (Make sure to give the images a corresponding name with the account and backup in a secure location). For restoration just rescan the QR codes in Google Authenticator.

7

As a preface this is an approach for configuring MFA ahead of time so that it is always backed up, not recovering or backing up existing codes.

I just went through this process after my Nexus 6P stopped connecting to data and I had to setup all my MFA again on a Pixel. I realized that if I lost my phone or did the factory data reset I'd have been totally borked.

The simplest solution I came up with is to ignore the QR code based setup and just use the token based setup itself (it's the "manual" option in most authenticator apps). Every service I've used so far allows you to opt for the token-based setup rather than QR.

Rather than going through the trouble of taking screen shots of the QR codes, labeling them appropriately and then GPG encrypting them and securely storing them somewhere I just store the tokens in an encrypted vault and setup my MFA manually.

I verified that you can setup clones of the authenticator using the same key on independent devices running simultaneously. Thus, so long as you securely control the tokens, you can configure MFA on any device.

I'm satisfied with this result as I didn't have to do anything more than reconfigure MFA (I had to do this anyway in my circumstances) and simply add all the tokens to lastpass. Now I'm covered in the case of phone loss and can configure other devices if need be.

6

There are a lot of advice for rooted phones. But it isn't recommended to root your device if you don’t want to make it vulnerable. Two-factor authentication provides an additional layer of protection and by rooting you bring it to naught since different viruses could get an access to protected memory areas.

Only small amount of services offer backup codes (particularly Google). For these services, you should save backup codes.

The best solution is to save the QR codes (or the secret keys) in the moment of token enrollment and keep them in some safe place. Then if you lose your phone you could restore tokens in Google Authenticator on your new device.

Also, you can use hardware tokens. They can be in the form of key fob or credit card. Have a look at this article on the blog of Protectimus (the company where I work) to get more information how to backup Google Authenticator: How to Backup Google Authenticator or Transfer It to a New Phone.

* Disclosure: I work for the website linked above.

0
4

Here is a link to simple Python script on my website: http://usefree.com.ua/google-authenticator-backup/

You just paste your code and run them in Python environment.

How it works:

During setting up and configuring two-factor authentication with Google Authenticator, it is possible not only to scan QR-code, but get the code, for example, for Google Mail we get: csnji4rfndisoh323fdsioah3u2iodso. For generating TOTP on your computer with Python IDLE your can define this function:

def totpgen ():
    import time
    import hmac
    import hashlib
    import base64

    ### TOTP-key for Google
    #secret = base64.b32decode("csnji4rfndisoh323fdsioah3u2iodso", True)
    #totp for btc-e
    #secret = base64.b32decode("DHSJHDW89E8DFUS98RIO23J390EFU234IR90WEUIF903DMSKAKDS====")
    ### Calc counter from UNIX time (see RFC6238) 
    counter = long(time.time() / 30)

    ### Use counter as 8 byte array
    bytes=bytearray()
    for i in reversed(range(0, 8)):
      bytes.insert(0, counter & 0xff)
      counter >>= 8

    ### Calculate HMAC-SHA1(secret, counter)
    hs = bytearray(hmac.new(secret, bytes, hashlib.sha1).digest())

    ### Truncate result (see RFC4226)
    n = hs[-1] & 0xF
    result = (hs[n] << 24 | hs[n+1] << 16 | hs[n+2] << 8 | hs[n+3]) & 0x7fffffff

    ### Print last 6 digits
    return str(result)[-6:]

Insert into line

secret = base64.b32decode("csnji4rfndisoh323fdsioah3u2iodso", True)

your code instead of "csnji4rfndisoh323fdsioah3u2iodso"

uncomment line, and call in IDLE

totpgen ()

You will get your TOTP!) For service btc-e try to use line

secret = base64.b32decode("DHSJHDW89E8DFUS98RIO23J390EFU234IR90WEUIF903DMSKAKDS====")

For other services - like described above.

0
4

2020.04.23†: Update the app, then go Settings > Transfer Accounts. (then breathe)

Takes me one second to scan QR codes between two phones, took us years to agree it was a feature worth coding even despite it's inherent security risks, meaning be careful, if you can scan in one second then so can someone else.

I believe https://android.stackexchange.com/a/224962/238005† first spotted there is now (after 2020) an official feature/ability to backup/export your list of accounts in a reasonable fashion, which is mentioned inconspicuously at https://support.google.com/accounts/answer/1066447 in the middle of nowhere. Sadly, am I really the first answer with this (official update) in this whole question thread? I fear for our life's data if this idea took this long to think of, and I had to learn through here. Because the option was hidden in a toolbar, and not even a Push Notification for this issue that actually matters.

1
  • (A) I mean I get Push Notifications for sports I never follow/read but not for Authenticator having its first feature improvement in a century, where are the top-down priorities/standards—for life-and-death tools like Authenticator—if this is not an important priority notification? (B) Or is the issue we programmers avoided, sensitive to talk about, the fact that this was easy for a programmer to do, but not for normal people til now, with this one update alone, & was it an issue about trusting users somewhat? It's a scary feature/ability, maybe there was hesitancy to notify of ability openly. Jul 30, 2021 at 4:08
4

Originally, when this question was asked, there was no simple solution: people would need to extract the data from an internal sqlite database that wasn't available unless your phone was rooted.

Fortunately, since the first half of 2020, the Google Authenticator app was updated:

WHAT'S NEW

  • Added the ability to transfer accounts to a different device, e.g. when switching phones
  • Refreshed the look and feel of the app

How you can export the codes from your Google Authenticator

  1. Tap on the ⋮ ellipsis at the top right (AKA overflow menu).
  2. Tap on Transfer accounts at the menu.
  3. Choose Export accounts.
  4. Unlock your phone (use the pin, pattern, password, biometrics…). (Sidenote: Your phone has this protection, right? You shouln't leave your phone totally unlocked.)
  5. Choose the accounts you wish to export. By default all accounts are already selected.
  6. Tap Next. A QR code will be generated.

Screencast showing how to export the codes from Google Authenticator

After exporting the accounts, Google Authenticator app will display a banner at the top: "Accounts were recently exported"

Additionally, it will warn the user with a notification, a few hours later.

Screenshot of the Google Authenticator notification

Intermission: understanding the QR codes

When a website shows you a QR code for enabling 2FA, the code encodes a URI like this:

otpauth://totp/Example:[email protected]?secret=…&issuer=Example&…

However, when you export the codes from Google Authenticator, the URI in the QR code is different:

otpauth-migration://offline?data=…

“The data parameter is a base64 encoded proto3 message (Google Protocol Buffers).” [citation] That message contains all the exported codes.

However, as you can see, the exported URI is formatted completely differently than the initial URI to setup 2FA. This means many 2FA apps won't be able to scan such QR code, because they won't understand the message.

How to use the exported QR code

Now that you have the QR code, you can use a second device to scan it. You have a few options.

① Import into Google Authentication on another device

At the Transfer accounts screen, choose Import accounts and scan the QR code.

② Import into another 2FA app

Aegis is an open-source 2FA app that allows importing data from multiple apps, and also allows exporting its own data (in an optionally encrypted JSON file). It can even show a standard otpauth-style QR code from any of its codes, making it trivial to export to any other app. It is available on both Google Play and F-Droid.

When using Aegis, just try to scan the QR code normally, as if you were doing a first-time 2FA setup. Aegis has native support for scanning otpauth-migration URIs from Google Authenticator.

There might be other apps with a similar feature, I'm just not aware of any of them.

③ Manually decode and extract the data

You can use a plain QR code scanner to decode the otpauth-migration URI from the QR code. Then you can use scito's tool or digitalduke's tool to extract the secrets and generate the appropriate otpauth URIs that can be imported into any app (after encoding them to QR codes).

References and acknowledgements

3

The following method will only work on rooted Android devices. This method is more useful for the not-so tech savvy people or the people like me > who don't want to waste time installing Android SDK + JDK from scratch just to run the adb command.

So here it is:

  1. Download and install any "Root explorer" app from Google Play store. I use the popular and free FX file explorer with its free FX root access addon. You can use others too. This app makes it possible for us to access the Android system as a root user.

  2. Once you open the file explorer in System root > Click "data" folder > Click "data" folder (inside the other data folder) > Copy the folder named com.google.android.apps.authenticator2 > Exit System root folder > Open normal Main storage / SD storage space and Paste the Folder here.

  3. Connect your android device to a PC and Backup the folder to a secure USB / external HDD.

That's it. Now, whenever you need to reinstall your firmware/ buy a new phone just follow the steps above and copy that folder to the exact same directory once you've installed the Google Authenticator app.

OR, you can use a free Open source SQLite GUI editor like "SQLite Database Browser Portable" to open the "databases" file inside the "com.google.android.apps.authenticator2" folder. In the "Browse Data" tab, you can see the key and name corresponding to the key so that you can manually enter the key into the Google Authenticator app.

5
  • @Izzy Edited out the subjective part and thanks for the help :) The method just looks big but is the most time saving for normal people who wouldn't be android devs. I actually looked at this thread before finding out a solution on my own. Backup codes - not available for most services (only works on google). Authenticator Plus is a paid app. Titanium backup can have compatibility issues. ADB pull command needs you to install Android SDK+JDK. My method is as "easy" as copy-pasting a folder. Dec 31, 2014 at 9:45
  • Thanks for the edit, Pavin! On your comment, I've got to partly disagree: I've never ever installed the SDK+JDK, but still use a bunch of ADB features (especially with my own tool "Adebar" for device documentation, backup/restore scripts and more). On Linux, I just need the adb executable for that (on Windows, two .dll files are required additionally). For details, see Is there a minimal installation of ADB?
    – Izzy
    Dec 31, 2014 at 12:11
  • PS: Have there ever been any permission issues? Copying the data directory of an app manually to another device might bring up such. Remember, to correctly access files the permissions and ownership must match. On installation, each app is assigned a unique UID/GID pair. File permissions have flags for owner/group/others. Usually, app data has at max -rw-rw-- (owner and group read/write, others nothing). So if there's a mismatch in ownership, you might be in trouble (and the app might misbehave).
    – Izzy
    Dec 31, 2014 at 12:17
  • Yeah, it works most of the time. But if it doesn't you can use any SQLite editor to open and view the secret key from the databases file; then proceed to add the account in Google Authenticator using the key. Dec 31, 2014 at 18:36
  • Ah. Better solution: If it does not work, check and adjust permissions. Before overwriting /data/data/com.google.android.apps.authenticator2, do an ls -l on it and check ownership/permissions. After copying, use chown and chmod to fix it back.
    – Izzy
    Dec 31, 2014 at 20:21
3

On a rooted phone, you can use the Amaze File Manager app.

  1. Go to the root /data/data/com.google.android.apps.authenticator2/database directory. Open the database file as a database.
  2. Select accounts. You will have 3 columns _id, email, and secret.
  3. Copy the secret value.
  4. When you need to restore just add, select "Enter a provided key", give it a name, and paste in the value.
1

As I have experienced same just some time before. When you would be signing in to your account you will get page for key to put 6 digit code. At this place you can change second key and get in phone number if you have any number verified already. And for more backup you can choose an other computers as trusted. So, they won't ask second step code on those computers.

1

Fast forward to April 2023, Google Authenticator now allows the user to sync the entries to their Google Account.

As reported on Google Security Blog - Google Authenticator now supports Google Account synchronization,

We are excited to announce an update to Google Authenticator, across both iOS and Android, which adds the ability to safely backup your one-time codes (also known as one-time passwords or OTPs) to your Google Account.

[...]

One major piece of feedback we’ve heard from users over the years was the complexity in dealing with lost or stolen devices that had Google Authenticator installed. Since one time codes in Authenticator were only stored on a single device, a loss of that device meant that users lost their ability to sign in to any service on which they’d set up 2FA using Authenticator.

With this update we’re rolling out a solution to this problem, making one time codes more durable by storing them safely in users’ Google Account. This change means users are better protected from lockout and that services can rely on users retaining access, increasing both convenience and security.

[...]

To try the new Authenticator with Google Account synchronization, simply update the app and follow the prompts.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .