Originally, when this question was asked, there was no simple solution: people would need to extract the data from an internal sqlite database that wasn't available unless your phone was rooted.
Fortunately, since the first half of 2020, the Google Authenticator app was updated:
- Added the ability to transfer accounts to a different device, e.g. when switching phones
- Refreshed the look and feel of the app
How you can export the codes from your Google Authenticator
- Tap on the ⋮ ellipsis at the top right (AKA overflow menu).
- Tap on Transfer accounts at the menu.
- Choose Export accounts.
- Unlock your phone (use the pin, pattern, password, biometrics…). (Sidenote: Your phone has this protection, right? You shouln't leave your phone totally unlocked.)
- Choose the accounts you wish to export. By default all accounts are already selected.
- Tap Next. A QR code will be generated.
After exporting the accounts, Google Authenticator app will display a banner at the top: "Accounts were recently exported"
Additionally, it will warn the user with a notification, a few hours later.
Intermission: understanding the QR codes
When a website shows you a QR code for enabling 2FA, the code encodes a URI like this:
However, when you export the codes from Google Authenticator, the URI in the QR code is different:
“The data parameter is a base64 encoded proto3 message (Google Protocol Buffers).” [citation] That message contains all the exported codes.
However, as you can see, the exported URI is formatted completely differently than the initial URI to setup 2FA. This means many 2FA apps won't be able to scan such QR code, because they won't understand the message.
How to use the exported QR code
Now that you have the QR code, you can use a second device to scan it. You have a few options.
① Import into Google Authentication on another device
At the Transfer accounts screen, choose Import accounts and scan the QR code.
② Import into another 2FA app
Aegis is an open-source 2FA app that allows importing data from multiple apps, and also allows exporting its own data (in an optionally encrypted JSON file). It can even show a standard
otpauth-style QR code from any of its codes, making it trivial to export to any other app. It is available on both Google Play and F-Droid.
When using Aegis, just try to scan the QR code normally, as if you were doing a first-time 2FA setup. Aegis has native support for scanning
otpauth-migration URIs from Google Authenticator.
There might be other apps with a similar feature, I'm just not aware of any of them.
③ Manually decode and extract the data
You can use a plain QR code scanner to decode the
otpauth-migration URI from the QR code. Then you can use scito's tool or digitalduke's tool to extract the secrets and generate the appropriate
otpauth URIs that can be imported into any app (after encoding them to QR codes).
References and acknowledgements
- prosody-Gabe Vereable Context's answer showed me the newly-available Transfer accounts feature.
- Related questions:
- Authenticator Test for a quick way to generating dummy 2FA codes.
- scrcpy for the screen recording.
- Google Authenticator blocks screenshots, but I could use scrcpy to record the screen anyway. (Although that seems to be blocked on newer Android versions.)
- ffmpeg and gifski for converting the video into a high-quality GIF, and then GIMP to manually edit the GIF to remove redundant frames and considerably reduce the final file size.