Transferring Google Authenticator to a New Phone: Complete Step-by-Step Guide

Google Authenticator generates time-based one-time passwords (TOTP) that expire every 30 seconds. If those secrets don’t reach your new device during a phone upgrade, you’re locked out of every account that relies on them.

Two migration methods exist: the built-in Export/Import QR code feature, which works offline and across platforms, and Google Account cloud sync (introduced May 2023), which automatically replicates codes to any device signed into the same Google account. Both work reliably when executed in the correct order—and that order always starts with backing up before you begin.

Before You Start: Backup Strategies to Protect Your Accounts

Skipping backups is the primary reason people end up locked out. Spend 20–30 minutes on these steps before touching either phone.

Save Recovery Codes From Every Enrolled Service

Most major platforms—Google, GitHub, Dropbox, AWS—generate one-time backup codes when you first enable 2FA. These codes bypass the authenticator app entirely. If you haven’t saved them, log into each service now and regenerate them. Store them in a password manager or a printed document kept in a physically secure location.

For how backup codes for Google work, including where to find and regenerate them, review that before proceeding.

Document Which Accounts Are Enrolled

Open Google Authenticator on your old phone and write down every account listed. A power user typically has 15–25 accounts across work and personal services. This list becomes your verification checklist after the transfer.

Screenshot Original Setup QR Codes (If Still Available)

Some services let you view the original QR code again from their security settings. If available, screenshot it and store it in an encrypted folder as a fallback if the transfer fails partway through.

Consider a Hardware Security Key as a Fallback

A FIDO2 hardware key registered as a backup authenticator on critical accounts (Google, financial services, work SSO) prevents a failed Authenticator transfer from cascading into a full lockout. This matters especially for teams where one person’s lockout can block shared account access.

Pro tip: Before starting the transfer, log into one of your 2FA-protected accounts using the old phone’s code to confirm Authenticator is still generating valid codes. This rules out pre-existing time-sync issues.

Method 1: Transfer Google Authenticator Using Export/Import Accounts (QR Code Method)

This method works regardless of cloud sync status and across Android and iOS. It requires both phones to be physically present and functional.

Export Process on the Old Phone

1. Open Google Authenticator on your old phone.
2. Tap the three-dot menu (Android) or ellipsis icon (iOS) in the top-right corner.
3. Select Transfer accounts.
4. Tap Export accounts.
5. Authenticate with your device PIN, fingerprint, or face unlock when prompted.
6. Select the accounts to transfer—all or specific ones.
7. Tap Next. The app generates one or more QR codes.

Common mistake: With more than 10 accounts, Google Authenticator splits them across multiple QR codes—sometimes 3 or 4. Users who scan only the first QR code end up missing accounts. Scroll through all generated codes and scan each one before assuming the transfer is complete.

Import Process on the New Phone

1. Install Google Authenticator from the App Store or Google Play on your new phone.
2. Open the app and tap Get started (or skip the sign-in prompt to use the QR method).
3. Tap Import existing accounts.
4. Point the new phone’s camera at the QR code displayed on the old phone.
5. If multiple QR codes were generated, scan each one sequentially.
6. Confirm the account list on the new phone matches what you exported.

Handling Multiple QR Codes

When transferring 15 accounts, expect 2–3 QR codes. The old phone displays them one at a time with a “Next” button. Scan each code on the new phone before tapping “Next” on the old phone—the codes are not persistent and cannot be regenerated from the same export session without starting over.

Method 2: Sync Google Authenticator via Your Google Account (Cloud Sync)

Google introduced cloud backup for Authenticator in May 2023, storing encrypted TOTP secrets in your Google Account. This is the simplest migration path when staying within the Google ecosystem.

How to Enable and Verify Cloud Sync

1. Open Google Authenticator on your old phone.
2. Tap your profile icon in the top-right corner.
3. If a Google account is listed with a sync icon, sync is already active. If not, tap Use without an account and switch to Sign in to sync.
4. Sign in with your Google account.
5. On your new phone, install Authenticator and sign in with the same Google account.
6. Accounts populate automatically within approximately 60 seconds.

Verifying Sync Is Active

After signing in on the new device, confirm the account count matches your old phone. A green cloud icon next to the profile picture confirms active sync. If accounts are missing, tap the profile icon and select Sync now.

Security Considerations for Cloud-Stored 2FA Secrets

Storing TOTP secrets in the cloud introduces a trade-off: convenience versus attack surface. If your Google account is compromised, an attacker could access your 2FA secrets. To mitigate this, ensure your Google account uses a strong, unique password and has a hardware security key registered as its own 2FA method—not Authenticator itself, which creates a circular dependency.

NIST SP 800-63B specifies that authenticator secrets should be stored with protections equivalent to the sensitivity of the accounts they protect. For most consumer use cases, Google’s encrypted sync is adequate. For high-value enterprise accounts, offline QR code transfer is the more conservative choice.

Cross-Platform Transfer: Android to iPhone or iPhone to Android

Switching operating systems requires no special process. The Export/Import QR code method works identically across platforms because both apps generate and read the same QR format.

Using the QR Code Method Across Platforms

Follow the same steps from Method 1. One platform-specific note: on iOS, Authenticator requires camera permission to scan QR codes. If you denied camera access during initial setup, go to Settings → Privacy & Security → Camera → Authenticator and enable it before attempting the import.

Using Cloud Sync for Cross-Platform Migration

Moving from Android to iPhone? Signing into your Google account in the Authenticator app on the iPhone pulls down all synced accounts immediately. This is the fastest cross-platform method and doesn’t require the old Android phone to be present—useful if you’ve already returned or sold it.

Pro tip: After a cross-platform transfer, verify that account labels transferred correctly. iOS and Android sometimes display account names differently based on how the issuer formatted the TOTP URI. A label showing “[email protected]” on Android might appear as just “account” on iOS.

What to Do If You Lost Your Old Phone Before Transferring

Recovery is possible, but the path depends on what backups you have.

Using Saved Backup Codes

Each service’s backup code lets you log in once without the authenticator app. Once logged in, navigate to security settings, disable 2FA temporarily, and re-enroll with your new phone. For a user with 20 accounts, this process takes roughly 45–90 minutes.

Account Recovery Flows and Support Contacts

For accounts without backup codes, most services offer identity verification recovery: security questions, trusted email verification, or government ID submission. Google’s account recovery flow uses trusted devices, recovery email, and recovery phone number, and can take 24–72 hours for manual review.

For work accounts (Google Workspace, Microsoft 365, Okta), contact your IT administrator directly. Enterprise identity platforms allow admins to bypass or reset MFA for individual users within minutes.

Common mistake: Repeatedly entering wrong codes triggers account lockouts on some platforms after 5–10 failed attempts. If you know you don’t have valid codes, go directly to the backup code or account recovery path rather than cycling through guesses.

Verifying Codes Work Correctly After Transfer

Before decommissioning the old phone, test the new device’s codes against at least two live services.

1. Pick an account from your new phone’s Authenticator list.
2. Navigate to that service’s login page in a browser.
3. Enter your username and password.
4. When prompted for the 2FA code, enter the current code from your new phone.
5. Confirm successful login.

Watch the 30-second timer in the Authenticator app. If the code is about to expire (under 5 seconds remaining), wait for the next one—partial-window submissions occasionally fail on stricter implementations.

Run this verification for your most critical accounts: primary email, financial services, and work SSO. Then cross-reference your written account list against what’s displayed on the new phone to confirm nothing is missing.

After the Transfer: Removing Accounts from Your Old Phone

Accounts are not automatically removed from the old phone after export. Both devices generate valid codes for the same accounts until you manually remove them—a security risk if the old phone is sold, lost, or accessed by someone else.

Removing Individual Accounts

1. Open Authenticator on the old phone.
2. Tap and hold an account entry (Android) or swipe left (iOS).
3. Select Remove or Delete.
4. Repeat for every account.

Factory Reset for Devices Being Sold or Recycled

After removing accounts, perform a factory reset. On Android: Settings → General Management → Reset → Factory data reset. On iPhone: Settings → General → Transfer or Reset iPhone → Erase All Content and Settings.

Also sign out of Google Account sync on the old device before the reset: open Authenticator, tap the profile icon, and select Sign out. This prevents residual sync activity from the old device.

Troubleshooting: Wrong Codes, Time Sync Errors, and Other Common Issues

Codes Are Rejected After Transfer

The most common cause is time drift. TOTP codes are valid for a 30-second window based on the device’s system clock. A clock off by more than 30 seconds causes every code to fail.

Fix on Android: Settings → General Management → Date and Time → enable Automatic date and time.

Fix on iOS: Settings → General → Date & Time → enable Set Automatically.

After enabling automatic time sync, restart Authenticator and test a code. Per RFC 6238, the TOTP algorithm requires synchronized clocks between client and server—a 60-second drift causes consistent failures.

Accounts Missing After Transfer

The most likely cause is a missed QR code during multi-code export. Re-run the export from the old phone and scroll through all generated codes carefully. For cloud sync, tap the profile icon on the new phone and select Sync now.

Duplicate Accounts Appearing

Duplicates appear when you use both the QR method and cloud sync for the same transfer. Both entries generate identical codes, so either can be deleted safely. Hold the entry and select remove.

App Not Recognizing Google Account for Sync

If the app shows “Use without an account” despite being signed into Google on the device, Authenticator may need its own sign-in. Tap Sign in to sync within the app and authenticate separately—the app maintains its own session independent of the device’s Google account.

Comparison: Export/Import QR Code vs. Google Account Cloud Sync

Decision framework:

• Both phones available, maximum security needed → QR code method
• Old phone lost or unavailable → cloud sync (if previously enabled) or backup codes
• Switching between Android and iPhone → either method works; QR code requires no Google account
• Managing 2FA across multiple devices regularly → enable cloud sync for ongoing convenience

Frequently Asked Questions

How do I transfer Google Authenticator to a new Android phone? Tap the three-dot menu → Transfer accounts → Export accounts, select your accounts, generate the QR code(s), then scan them on the new Android phone after installing Authenticator. Alternatively, sign into the same Google account on the new phone to sync via cloud.

How do I transfer Google Authenticator to a new iPhone? The process is identical to Android. Install Authenticator on the iPhone, tap Import existing accounts, and scan the QR code from your old phone. Ensure camera permission is enabled on the iPhone before scanning.

What happens if I lose my old phone before transferring Google Authenticator? Use saved backup codes to log into each account individually, then re-enroll 2FA with your new phone. If cloud sync was enabled, signing into Authenticator on the new phone with your Google account recovers all codes automatically.

Will my accounts be removed from my old phone after transfer? No. Accounts remain on the old phone until you manually delete them. Always remove accounts from the old device and perform a factory reset before selling or recycling it.

How do I use backup codes if I cannot access my old phone? Navigate to the service’s login page, enter your credentials, and when prompted for a 2FA code, look for “Try another method” or “Use backup code.” Enter one of your saved backup codes. Each code is single-use.

Does Google Authenticator automatically sync to a new phone through my Google account? Yes, if cloud sync is enabled. Sign into Authenticator on the new phone with the same Google account, and all TOTP secrets sync within approximately 60 seconds. This requires Authenticator version 6.0 or later (released May 2023).

Can I transfer Google Authenticator from Android to iPhone or iPhone to Android? Yes. The Export/Import QR code method works across platforms without modification. Cloud sync also works cross-platform since it’s tied to the Google account, not the device OS.

Why are my Google Authenticator codes not working after transferring to a new phone? Time drift is the primary cause. Enable automatic date and time in your device settings. If codes still fail, check for duplicate accounts and verify you’re entering the code for the correct account—similar-looking account names are a common source of confusion.

Conclusion

The Export/Import QR code method gives you offline, cross-platform control over exactly which accounts move and when. Google Account cloud sync offers a faster path for users already in the Google ecosystem, particularly when the old phone isn’t available.

The step that separates a smooth transfer from a lockout is preparation: saving backup codes, documenting enrolled accounts, and testing codes on the new device before wiping the old one. Verify every account transferred correctly, then remove all Authenticator data from the old phone before it leaves your hands.

Understanding how verification codes work helps you manage them more confidently across device upgrades, platform switches, and recovery scenarios. Keep backup codes current, keep recovery options updated, and the next phone transfer will take under 10 minutes.