How to move Google Authenticator to a new phone without the old one

Which apps keep a backup you can restore from

Three mainstream apps keep a copy of your codes off the phone, and one used to but is winding down. Google, Microsoft and 1Password all document where the backup lives, so you can tell which one you have before you start.

App	Where the backup lives	What restores it	Limits to know
Google Authenticator	Your Google Account, through sync	Sign in to the app on the new phone and the codes appear	Needs version 6.0 or later on Android, or 4.0 or later on iOS. Google encrypts the codes in transit and at rest
Microsoft Authenticator on Android	A Microsoft personal account, moving to Google One from January 2027	Sign in, then choose Restore from backup	Restore only works between the same device type. Work and school accounts restore the account name only
Microsoft Authenticator on iOS	iCloud	Sign in with the same Apple Account, then restore	Same device type only, so an iPhone backup will not restore on an Android phone
1Password	Your 1Password vault	Sign in on the new phone and open the site’s Login item	The code is saved on the Login item, so the vault’s own sync is the backup
Authy	Twilio’s servers, encrypted with a password only you know	Sign in and restore from backup	Authy did not back up at all unless you set that encryption password, as BleepingComputer reported in April 2023. Twilio’s docs still list the Authy app as a free consumer app and say the company is committed to maintaining the mobile apps, but the desktop apps hit end of life on March 19, 2024 and the Authy API is closed to new customers

Google Authenticator’s sync arrived on April 24, 2023. Before that, codes sat on one device only, and losing that device meant losing the ability to sign in to anything set up with the app. Google’s group product manager wrote in the announcement that the change was meant to make one-time codes “more durable by storing them safely in users’ Google Account.”

The fast path: sign in and the codes come back

For Google Authenticator the fix takes a couple of minutes. Install the app on the new phone, tap Get Started, and sign in with the same Google Account you used before. Google says that when you sign in to your Google Account within Authenticator on a new device, your codes sync to that device automatically.

Two details catch people out. First, if you chose Use without an account in the app, there is no sync to restore, and Google warns that switching to that mode removes codes from your Google Accounts and stores them on the device only. Second, the sync feature needs version 6.0 or later on Android, or 4.0 or later on iOS, so update the app before you sign in.

Microsoft Authenticator works the same way with a different switch. On Android, open the app, tap the menu, choose Settings and turn on Cloud Backup, then pick the Microsoft personal account that holds the backup. On the new phone, sign in with that account and pick Restore from backup. If that option does not appear, Microsoft says you need to remove or sign out of all accounts in the app before the restore will show.

If there was no backup, work through the accounts one at a time

This is the slower path, and the order matters. Start with the accounts that can reset the others: your email, then your password manager, then your bank. Everything else can wait.

For each site, sign in with your password, open its security settings, turn off the authenticator app as a method, then choose to set it up again and scan the fresh QR code with the new phone. Each site has its own wording for this, but the shape is the same.

If you cannot sign in at all, you have these ways back in:

• Backup codes. Google gives you 10 at a time, each one works once, and you can print or download them from the 2-Step Verification page. At the sign-in screen, choose Try another way, then Enter one of your 8-digit backup codes.
• Your recovery email or recovery phone. Google sends a code to one of these to help prove it is you. Keep them on a device that is not the phone you lost, and never use a Google Voice number as a recovery number, because the code would go to the same account you are trying to get into.
• A recovery contact. You can nominate someone you trust, and they get a request with a 7-day window to help you back in.
• The account recovery form at accounts.google.com/signin/recovery. Google says wrong guesses do not lock you out, so answer the questions as well as you can.

For other sites, look for their own “lost my authenticator” or “can’t access my account” form. If a code arrives that you did not ask for, treat it as a warning, not a nuisance. Our page on verification codes you did not request explains where those come from, and our guide to what happens after a data breach notice covers the same ground.

Before you wipe the old phone

If the old phone still works, take two minutes with it first. In Google Account, go to Security and sign-in, then Your devices and Manage all devices. Select the device and choose Sign out. If your codes were synced, Google says removing the device from your Google Account also removes the codes from it, which stops anyone holding the phone from reading your codes.

If the phone is gone, use the remote erase option for iOS or Android to lock and wipe it, then sign out the same device entry from your Google Account. For a work phone, your IT department usually handles this.

Work and school accounts work differently

A work or school account is not a personal account, and the backup rules are stricter on both platforms.

Microsoft backs up only the account name for work and school accounts, so after a restore you have to sign in again on the new phone to finish setting it up. Third-party one-time passwords for services such as Amazon, Facebook or Gmail do come back, as long as the backup was on the same type of device.

For Google accounts used through work, school or another group, Google says recovery steps might not work and to ask the administrator for help. A Workspace administrator can also enforce a 2-Step Verification method for a group, including requiring security keys only, which rules out an authenticator app entirely. If the app will not sync at all, that is worth checking before you try anything else.

What cloud backup costs you in security

Syncing means your second-factor secrets sit on someone else’s server, so it is worth knowing exactly how they are protected. Google’s own help page says it encrypts Authenticator codes both in transit and at rest across its products. That is not the same as end-to-end encryption, where only your device can read the data, and the current help page still offers no end-to-end option for Authenticator. When sync launched in 2023, Google told BleepingComputer that it planned to add end-to-end encryption to Authenticator “in the future”, and said the reason was that end-to-end encryption can lock users out of their own data without a recovery path.

The practical effect is that someone with your Google account password can install Authenticator and read your codes for every site you have set up. That is why Google’s own list of good habits includes enrolling more than one form of 2-Step Verification, adding a passkey, and turning on Privacy Screen inside the app so a PIN or fingerprint is needed before codes are shown.

What to do next

1. Check whether your codes were ever synced or backed up. Open Google Authenticator on the old phone, tap your profile picture and see whether a Google Account is listed. If it is, install the app on the new phone and sign in with that account.
2. If there was no backup, print a fresh set of backup codes from the Google Account 2-Step Verification page, then work through email, password manager and bank first.
3. Sign out the old phone from your Google Account before you wipe or sell it, so the codes on it stop working.
4. Turn on sync, backup codes, a recovery email and a recovery phone that is not the phone in your pocket. Then add a passkey, which is covered in our guide to what happens to passkeys if you lose your phone.
5. If a company account is involved, ask your administrator to confirm which authenticator methods are allowed before you set up the new phone.

Sources

• Get verification codes with Google Authenticator, Google Account Help
• Sign in with backup codes, Google Account Help
• How to recover your Google Account or Gmail, Google Account Help
• Set up recovery options, Google Account Help
• Turn on 2-Step Verification, Google Account Help
• Deploy 2-Step Verification, Google Workspace Admin Help
• See devices with account access, Google Account Help
• Back up your accounts in Microsoft Authenticator, Microsoft Support
• Restore account credentials from Microsoft Authenticator, Microsoft Support
• Use 1Password as an authenticator for sites with two-factor authentication, 1Password Support
• Google Authenticator now supports Google Account synchronization, Google Security Blog, April 24, 2023
• Google Authenticator can now sync 2FA codes to the cloud, TechCrunch, April 24, 2023
• Google will add end-to-end encryption to Google Authenticator, BleepingComputer, April 26, 2023
• Verify vs. Authy, Twilio Docs
• End of Life of Twilio Authy Desktop Apps, Twilio changelog, February 19, 2024