I'm starting to use Google Authenticator for more and more things now, but I've just realized that if I lose my phone, or if I need to wipe and restore it to install new firmware, I will lose all of my codes.

Is there anyway to back them up please? Or some kind of fallback that means I can restore it to a new device?

Thanks

  • 2
    I don't understand... A code is to be used only once, they aren't stored anywhere on your phone, if you need to enter a code on a site, you have to use a new code, even if you already put one on this site some time ago. – Matthieu Harlé Feb 11 '14 at 9:08
  • 1
    Thank you, but as I understand it, if I lose my phone now, I won't even be able to login to the site, let alone setup a new Google Authenticator code – Nick Feb 11 '14 at 9:31
  • 5
    If you need a code to log-in while your phone is lost, you can use one of the backup method (SMS, Call, printed codes...). It is highly recommended to setup at least one of these alternative method to overcome this kind of situation :) – Matthieu Harlé Feb 11 '14 at 10:09
  • 3
    I've always wanted to fork Google Authenticator to add this feature. I'm hoping somebody will do it before I have the time. – Michael Kropat Feb 11 '14 at 15:27
  • 5
    @Shywim Google Authenticator is not just for Google accounts. There are many other services that do not have backup codes and SMS etc. – Chris Harrison Sep 10 '16 at 7:46

13 Answers 13

The following method will only work rooted Android devices.

Linux:

adb pull /data/data/com.google.android.apps.authenticator2/databases/databases /AFolderOnPC

Windows:

adb pull /data/data/com.google.android.apps.authenticator2/databases/databases C:\AFolderOnPC

Note that the folder on the PC has to already exist.

This will copy the authenticator database files with the main keys, from which the One Time Passwords are generated, to the PC. The file can then be restored to the same location, on Android devices, or read with an sqlite database viewer to extract the keys.

  • 9
    When copying to a new device, make sure the databases folder and databases file both have 755 permissions. I tried 700, and GA kept crashing. Kind of concerning that it requires full permissions. Maybe that's NSA's requirement. – eduncan911 Jun 22 '15 at 23:40
  • 11
    You need to adb root before you do this, or you will get remote object '/data/data/com.google.android.apps.authenticator2/databases' does not exist – Simon Woodside Sep 15 '16 at 2:27
  • 3
    Note that if you have SELinux enabled, even with the correct permission bits the Authenticator app can crash. To fix this, run restorecon -F /data/data/com.google.android.apps.authenticator2/databases/databases after you put back the database file. (source) – Dreaming in Code Jul 24 '17 at 7:13
  • @eduncan911 660 works for me – deed02392 Nov 20 '17 at 22:08
  • Rooting your device makes it less secure. If you're using 2FA then presumably you want more security. For the risks: owasp.org/index.php/Projects/… – Simon Woodside Dec 5 '17 at 17:36

You don't need to back up the Google Authenticator app/data as you can create a list of 'Backup codes' which you can use to log in without requiring a authentication code on the same page that you configure 2-step authentication.

Why print or download backup codes?

Backup codes are especially useful for people who travel, have problems receiving SMS or voice calls, or cannot use the Google Authenticator mobile app.

Recommendation: You should print or download backup codes

Store these in a safe place (or print them out) and if you lose your phone you can use one of these codes to log into your account and set up a new device with the Authenticator app.

Whilst this applies to Google's 2-step-authentication, any other sites you have configured to use the Google Authenticator app should offer a similar option, or another way to receive codes (e.g. Facebook supports Google Authenticator, their own app and sms as methods to receive codes).

  • 1
    Many thanks, so effectively I could create my own backups then, by saving a copy of the QR code used to setup Google Authenticator for each site too? – Nick Feb 11 '14 at 10:12
  • 3
    For the sites that don't offer it then i'd say that your only option is to use a strong unique password without 2 step authentication. Out of interest, what sites don't offer a backup option? Dropbox, Facebook, LastPass, Wordpress all do (those are the other sites I use 2 step authentication with). – bmdixon Feb 11 '14 at 11:38
  • 16
    @Nick: Saving the QR code that Google or other sites provide and adding them back into Authenticator on another device does work. I have done this a few times myself. However you should make sure that the time is correct and up to date constantly on both devices (if you intend on keeping using both of them) otherwise authentication might fail. – Andris Feb 11 '14 at 12:57
  • 6
    The two-factor authentication "one-time" password is generated with two things: the current time, and a secret shared between the server and the app during the initialization. In your case, the secret is the QR code. As long as another instance of the authenticator app shares the same secret and the same time (the same 30s frame), both apps will generate the same passwords. – Marc Plano-Lesay Feb 11 '14 at 15:55
  • 3
    This is only true for Google's 2-step authentication. Google authenticator works with many other sites, and some don't have a way to create a list of backup codes. Some use SMS, some give you a single one-time-use backup code, and some don't have any backup option at all. Even when every site has a backup option, having to restore all of the many keys when getting a new phone is a huge hassle. – Laurence Gonsalves Jun 13 '17 at 16:56

Titanium Backup (link to Google play store) will backup any android app, including Google Authenticator. However, you must root your phone for this to be a viable option.

I would also recommend printing the Google backup codes too. This isn't quite backing up the Google Authenticator app, but they would allow you to reset the authenticator if necessary. This would only help for regaining access to your Google account though.

Backing up the app with Titanium Backup is the most complete option, in my opinion. It's saved me on a number of occasions.

  • Had to settle for this because I couldn't adb pull the databases directory, couldn't copy to /sdcard and take it - chmod 777 did nothing. – Lauri Elias Aug 30 '17 at 9:39
  • "Import from Google Authenticator" -- Sold! Very important migration feature. – Adambean Aug 31 '17 at 7:18

I had the exact same problem.

It turns out that original tokens (usualy represented to the user as qrcodes) are stored in sqlite database inside /data/data/com.google.android.apps.authenticator2/databases folder and can be extracted from the device.

I automated and explained the recovery process here: https://github.com/dchapkine/extract-google-authenticator-credentials

This project extracts original tokens, then generates a web page with qrcodes you can rescan on a new device.

Feel free to contribute.

  • This just saved me logging into all of my 2FA accounts and switching the phone manually. Many thanks! – Kovah Jun 21 '16 at 5:41
  • This is exactly what I was looking for. A quick and easy way to re-scan all of the QR codes. – Harvey Nov 27 '17 at 18:08
  • Thanks for this but my device is not rooted. Do I understand correctly that I have a "Catch 22" situation on my hand where rooting my device will wipe it clean? – urig Dec 28 '17 at 20:07
  • Simply brilliant. Didn't work on Windows 10 Bash though. – TranslucentCloud Feb 1 at 20:19
  • @urig, no, rooting of some phones won't necessarily wipe apps data. – TranslucentCloud Feb 1 at 21:47

Try Authenticator Plus, it supports backup/restore functionality with sync across devices, if you have a phone/tablet, this app syncs all accounts between them flawlessly, it even support Android wear.

It has logos support too Authenticator Plus Screenshot

  • 13
    Or you could use Authy (authy.com), which is free. – lid Jul 26 '14 at 1:56
  • 5
    Authy looks awesome! Much better than google's, except it's not opensource. I can live with it. – cregox Nov 29 '14 at 18:58
  • 17
    Doesn't this sound like a bad idea? The whole point of the Time-based One-time pad protocol (TOTP aka rfc6238, which is what authy/google authenticator, et al implement) is that you and only you have the ability to generate the codes. If you let some 3rd party store those codes, they become a huge target for attacks, nevermind having to trust everybody that works for this service and how they've implmented it. – antiduh Apr 28 '15 at 18:19
  • 1
    @antiduh of-course its matter of security vs usability, if you are more concerned with security its not ideal for you and you should actually move away from software solutions and use hardware solutions like yubikey – Riyaz Mohammed Ibrahim May 7 '15 at 6:07

The easiest way to handle this is to take a screenshot of the QR code whenever you setup a new Authenticator for a site and save it in an encrypted location.

If you need to reinstall or add the Authenticator for that site to another phone, simply add the account in Authenticator by scanning the QR code in the screenshot just as if you were setting up a new site.

Before you negativoids say this won't work, yes it does, and you CAN have the same Authenticator on multiple devices.

  • Yes! This works! Thanks – Dhrumil Bhankhar Dec 25 '16 at 15:37
  • 1
    I would like to explain why this works, both the website and your device will share a simple string of characters, "the code", set in the QR code, and they will endlessly use it to create new 6 digit codes from, based on the current date and time. Therefore, you only need to have this code to generate new codes. The website has no way of checking who or what created the 6 digit code, it only needs to be correct. – Arie Aug 3 '17 at 14:18

You can save the QR codes when you setup or renew your 2FA. You can save the QR by making a screenshot. Or using the context menu 'save image as' but this is not always available. (Make sure to give the images a corresponding name with the account and backup in a secure location). For restoration just rescan the QR codes in Google Authenticator.

As a preface this is an approach for configuring MFA ahead of time so that it is always backed up, not recovering or backing up existing codes.

I just went through this process after my Nexus 6P stopped connecting to data and I had to setup all my MFA again on a Pixel. I realized that if I lost my phone or did the factory data reset I'd have been totally borked.

The simplest solution I came up with is to ignore the QR code based setup and just use the token based setup itself (it's the "manual" option in most authenticator apps). Every service I've used so far allows you to opt for the token-based setup rather than QR.

Rather than going through the trouble of taking screen shots of the QR codes, labeling them appropriately and then GPG encrypting them and securely storing them somewhere I just store the tokens in an encrypted vault and setup my MFA manually.

I verified that you can setup clones of the authenticator using the same key on independent devices running simultaneously. Thus, so long as you securely control the tokens, you can configure MFA on any device.

I'm satisfied with this result as I didn't have to do anything more than reconfigure MFA (I had to do this anyway in my circumstances) and simply add all the tokens to lastpass. Now I'm covered in the case of phone loss and can configure other devices if need be.

There are a lot of advice for rooted phones. But it isn't recommended to root your device if you don’t want to make it vulnerable. Two-factor authentication provides an additional layer of protection and by rooting you bring it to naught since different viruses could get an access to protected memory areas.

Only small amount of services offer backup codes (particularly Google). For these services, you should save backup codes.

The best solution is to save the QR codes (or the secret keys) in the moment of token enrollment and keep them in some safe place. Then if you lose your phone you could restore tokens in Google Authenticator on your new device.

Also, you can use hardware tokens. They can be in the form of key fob or credit card. Have a look at this article on the blog of Protectimus (the company where I work) to get more information how to backup Google Authenticator: How to Backup Google Authenticator or Transfer It to a New Phone.

* Disclosure: I work for the website linked above.

  • 2
    Welcome to Android Enthusiasts. We noticed that you are affiliated with the mentioned link. Even though you have stated your affiliation on your profile, please also disclose it in your answer. Further reading: How to not be a spammer. – Andrew T. Jan 25 at 16:11
  • @AndrewT. Done. – iBug Jan 25 at 16:36

The following method will only work on rooted Android devices. This method is more useful for the not-so tech savvy people or the people like me > who don't want to waste time installing Android SDK + JDK from scratch just to run the adb command.

So here it is:

  1. Download and install any "Root explorer" app from Google Play store. I use the popular and free FX file explorer with its free FX root access addon. You can use others too. This app makes it possible for us to access the Android system as a root user.

  2. Once you open the file explorer in System root > Click "data" folder > Click "data" folder (inside the other data folder) > Copy the folder named com.google.android.apps.authenticator2 > Exit System root folder > Open normal Main storage / SD storage space and Paste the Folder here.

  3. Connect your android device to a PC and Backup the folder to a secure USB / external HDD.

That's it. Now, whenever you need to reinstall your firmware/ buy a new phone just follow the steps above and copy that folder to the exact same directory once you've installed the Google Authenticator app.

OR, you can use a free Open source SQLite GUI editor like "SQLite Database Browser Portable" to open the "databases" file inside the "com.google.android.apps.authenticator2" folder. In the "Browse Data" tab, you can see the key and name corresponding to the key so that you can manually enter the key into the Google Authenticator app.

  • @Izzy Edited out the subjective part and thanks for the help :) The method just looks big but is the most time saving for normal people who wouldn't be android devs. I actually looked at this thread before finding out a solution on my own. Backup codes - not available for most services (only works on google). Authenticator Plus is a paid app. Titanium backup can have compatibility issues. ADB pull command needs you to install Android SDK+JDK. My method is as "easy" as copy-pasting a folder. – Pavin Joseph Dec 31 '14 at 9:45
  • Thanks for the edit, Pavin! On your comment, I've got to partly disagree: I've never ever installed the SDK+JDK, but still use a bunch of ADB features (especially with my own tool "Adebar" for device documentation, backup/restore scripts and more). On Linux, I just need the adb executable for that (on Windows, two .dll files are required additionally). For details, see Is there a minimal installation of ADB? – Izzy Dec 31 '14 at 12:11
  • PS: Have there ever been any permission issues? Copying the data directory of an app manually to another device might bring up such. Remember, to correctly access files the permissions and ownership must match. On installation, each app is assigned a unique UID/GID pair. File permissions have flags for owner/group/others. Usually, app data has at max -rw-rw-- (owner and group read/write, others nothing). So if there's a mismatch in ownership, you might be in trouble (and the app might misbehave). – Izzy Dec 31 '14 at 12:17
  • Yeah, it works most of the time. But if it doesn't you can use any SQLite editor to open and view the secret key from the databases file; then proceed to add the account in Google Authenticator using the key. – Pavin Joseph Dec 31 '14 at 18:36
  • Ah. Better solution: If it does not work, check and adjust permissions. Before overwriting /data/data/com.google.android.apps.authenticator2, do an ls -l on it and check ownership/permissions. After copying, use chown and chmod to fix it back. – Izzy Dec 31 '14 at 20:21

On a rooted phone you can use the "Amaze" file manager (https://play.google.com/store/apps/details?id=com.amaze.filemanager&hl=en). Go to the root /data/data/com.google.android.apps.authenticator2/database directory. Open the database file as a database. Select accounts. You will have 3 columns _id, email, and secret. Copy the "secret" value. When you need to restore just add, select "Enter a provided key", give it a name and paste in the value.

As I have experienced same just some time before. When you would be signing in to your account you will get page for key to put 6 digit code. At this place you can change second key and get in phone number if you have any number verified already. And for more backup you can choose an other computers as trusted. So, they won't ask second step code on those computers.

Here is a link to simple Python script on my website: http://usefree.com.ua/google-authenticator-backup/

You just paste your code and run them in Python environment.

How it works:

During setting up and configuring two-factor authentication with Google Authenticator, it is possible not only to scan QR-code, but get the code, for example, for Google Mail we get: csnji4rfndisoh323fdsioah3u2iodso. For generating TOTP on your computer with Python IDLE your can define this function:

def totpgen ():
    import time
    import hmac
    import hashlib
    import base64

    ### TOTP-key for Google
    #secret = base64.b32decode("csnji4rfndisoh323fdsioah3u2iodso", True)
    #totp for btc-e
    #secret = base64.b32decode("DHSJHDW89E8DFUS98RIO23J390EFU234IR90WEUIF903DMSKAKDS====")
    ### Calc counter from UNIX time (see RFC6238) 
    counter = long(time.time() / 30)

    ### Use counter as 8 byte array
    bytes=bytearray()
    for i in reversed(range(0, 8)):
      bytes.insert(0, counter & 0xff)
      counter >>= 8

    ### Calculate HMAC-SHA1(secret, counter)
    hs = bytearray(hmac.new(secret, bytes, hashlib.sha1).digest())

    ### Truncate result (see RFC4226)
    n = hs[-1] & 0xF
    result = (hs[n] << 24 | hs[n+1] << 16 | hs[n+2] << 8 | hs[n+3]) & 0x7fffffff

    ### Print last 6 digits
    return str(result)[-6:]

Insert into line

secret = base64.b32decode("csnji4rfndisoh323fdsioah3u2iodso", True)

your code instead of "csnji4rfndisoh323fdsioah3u2iodso"

uncomment line, and call in IDLE

totpgen ()

You will get your TOTP!) For service btc-e try to use line

secret = base64.b32decode("DHSJHDW89E8DFUS98RIO23J390EFU234IR90WEUIF903DMSKAKDS====")

For other services - like described above.

  • 2
    Could you include the relevant code and explain how to use it? (e.g. what does this code do? Paste "what" code & from where? Not everybody understands Russian). Link-only answer is discouraged, since if the link rots, then there is nothing useful left. (Also, disclosure is needed if you intend to promote your blog. Otherwise, it might be assumed as purely promotional aka spam). – Andrew T. Apr 14 '15 at 1:21
  • 1
    Please don't be a spammer, and include a clear, obvious mention that it's your site, next to the link itself. – Nic Hartley Sep 11 '17 at 17:11

protected by Community Nov 29 '17 at 2:10

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.