Move Google Authenticator Without Losing Your Security Codes

Your Authenticator codes can move with you. Google Authenticator adds an extra layer of account protection by generating one-time codes required to access linked accounts, but changing phones can become unpleasant when those codes stay behind.

Google Authenticator has synced one-time codes in the cloud since 2023. If you use a Google account, the app sends your codes to the cloud on Android version 6.0 or above and iOS version 4.0 or above, giving you a much cleaner route to a new device.

Move Authenticator codes through the cloud

First, check whether your codes are saved. Open Google Authenticator and look for the cloud icon beside your account icon. That icon shows whether the codes on your phone are syncing to the cloud.

Once the codes are saved, install and start Google Authenticator on your new phone, then continue with the same account. Your codes should move into the app on the new device without requiring a manual export. This method also protects you if your old phone is lost or destroyed — a useful feature for anyone who enjoys not being locked out of every account at once.

Cloud backups did not become available until 2023, so older instructions may focus on a manual process. Manual Authenticator transfers for Android devices were not possible until 2020, which explains why the migration advice around the app has changed over time.

Transfer codes without a Google account

If you do not want to use Authenticator with a Google account, keep the old phone nearby. Open the app menu on that device and go to Transfer Accounts > Export Accounts.

Select the codes you want to move, and the old phone will produce a QR code. On the new phone, open the same Transfer Accounts area, choose Import Accounts, and scan the QR code. The codes will transfer directly between the two devices.

If the old phone is unavailable and the codes were not saved to the cloud, recovery becomes less tidy. If you are still signed in to an account on another device, that account will generally let you disable 2FA for a short time so you can sign in elsewhere. When your email and phone are linked to the account, you should be able to recover it, even if the account provider needs to handle the problem.

The better plan is to prepare when you enable Authenticator, not after your phone has vanished. Save the codes to the cloud or create backup codes by opening your Google account and navigating to Security & Sign-in > 2-Step Verification, then open the Backup codes section.

Use the same security discipline across your phone

Authenticator is only one part of mobile security. Apps can request access to your camera, location, text messages, files, contacts, photos, or microphone, and a permission request does not prove an app is unsafe. It does deserve a question: why does that app need access?

Android and iOS include security measures that detect and block malicious apps, while both systems let you review permissions through their settings menus. Android users can long-tap an app icon, choose the i icon, open Permissions, select a data type, and choose Allow or Don’t allow. The same controls are available through Settings > Apps > See all apps.

Android also offers the Privacy dashboard, which shows permission types and the apps that accessed them during the past 24 hours. Location access can be set to All the time or Allow only while using the app, while the Play Store lists the information an app may request before installation.

On iOS, permission controls live under Settings > Privacy & Security. That section lists each permission type and the number of apps using it; tapping Microphone, for example, shows every app with microphone access, and switching off a toggle revokes permission.

iOS also lets you choose Allow Once for location access or Allow While Using App. Camera roll access can use Limited Access, which lets you select only the photos and videos an app may see. Google Maps and Uber may work best with Precise Location and Always access, but those permissions can still be changed per app.

Both systems show when sensitive features are active. The iPhone uses a green dot for the camera, an orange dot for the microphone, and a blue location icon when an app checks your whereabouts. Android phones use similar status bar icons, and you can swipe down to inspect the quick settings panel or Control Center.

Treat password warnings as a prompt to act

A password leak warning does not prove your account was hacked. On iPhone, iOS compares passwords stored in the Passwords app with leaked password data, including cases where the listed website has not reported a breach.

Open Passwords and authenticate with Face ID, Touch ID, or your passcode. Tap Security, choose an affected account, and check whether the password is marked as leaked, reused, or weak. Then tap Change Password to visit the service’s website or app and replace the exposed credential with a unique one.

Changing the password stored in Apple’s Passwords app does not change the account password. Update the password on the website first, then update the saved credential; most password managers should offer to update their stored information.

Apple checks saved credentials against a local list of commonly leaked passwords. For passwords outside that list, the iPhone uses privacy-preserving cryptographic checks with Apple’s servers, sending information derived from the password rather than the password itself. Apple says it does not keep that information, and its warning does not identify where the leak occurred.

Apple’s Passwords app stores logins and passkeys and can sync through iCloud Keychain with end-to-end encryption. Google Password Manager offers similar checks through Chrome on iPhone, while 1Password provides similar functionality. If monitoring is off, check Settings > Apps > Passwords > Detect Compromised Passwords.

When a suspicious email, text, or browser pop-up claims that your password leaked, ignore its links and check the Passwords app instead. Security preparation is less exciting than account recovery, but it beats discovering that your entire digital life depends on one missing phone.

Stay connected via Google News

Follow us for the latest AI News