How to back up Google Authenticator before you lose your phone

Most people only think about backing up Google Authenticator after their phone is gone, and by then it can be too late. It only takes a few minutes to protect yourself, so here are your options, what each one does, and what to do if you have already lost your phone.

Why you should back up Google Authenticator

Authenticator codes come from a secret stored by the app. If the only copy lives on one phone and that phone is lost, broken, or stolen, the codes go with it, and you can be locked out of every account that depends on them. A good backup means you can recover those codes on another device.

Option 1: Sync to your Google Account

This is the simplest built-in option. According to Google's help page, codes saved to your Google Account sync automatically, and they appear when you sign in to Authenticator on a new device.

1. Open Google Authenticator and sign in with your Google Account.
2. Check that your account appears in the app, so you know your codes are being saved to it.

The trade-off is that your codes now depend on access to that Google Account. Make sure you can still get into it without this phone.

Option 2: Export a QR code to a second device

Google Authenticator can export your codes as a QR code that another device scans. The labels below come from Google's help page and may differ slightly by app version.

1. Install Google Authenticator on the second device.
2. On your current phone, open the menu and tap Transfer codes, then Export codes.
3. Unlock your device when asked, select the accounts, and tap Next.
4. On the second device, open the menu and tap Transfer codes, then Import codes, and scan the QR code. If you have many accounts, you may need to scan more than one.

This gives you a real second copy, but you have to repeat it each time you add an account, and it only helps if that second device survives too.

Option 3: Save each site's backup codes

Most sites give you one-time backup codes when you turn on two-factor. Save them somewhere safe and separate from your phone. They are your way back in when everything else fails, and you can often generate new ones in the site's security settings.

Option 4: Import your codes into VaultKeep

I built VaultKeep because of this exact problem. It keeps your authenticator codes in an encrypted vault that syncs across the web, your browser extension, and Android, so losing one device does not mean losing your codes. It is encrypted on your device before upload, so the server only stores ciphertext.

1. Create a free VaultKeep account and store your recovery kit somewhere safe.
2. In Google Authenticator, follow the export steps above to show the QR code.
3. In your VaultKeep vault, open the Authenticator tab and choose + Add code.
4. Choose Camera to scan the QR code, or Photo to upload a screenshot of it.
5. Review the list under Import from Google Authenticator, select your accounts, and import them.
6. Repeat for each QR code if Google Authenticator made more than one.
7. Compare a code or two against Google Authenticator, and try logging in to confirm they work.
8. Delete any screenshot you took, because it contains your two-factor secrets.

You can save your backup codes in VaultKeep as well, in the Backup tab. Just make sure a single lost password cannot lock you out: keep your VaultKeep recovery kit somewhere other than your vault.

Which backup should you choose?

Whichever you pick, do not rely on just one. A sensible setup is one synced copy of your codes, either your Google Account or a vault like VaultKeep, plus each site's backup codes stored separately.

What to do if you already lost your phone

1. Secure the phone first. Use remote erase for Android or iPhone if you can, so nobody else can reach your codes.
2. Check for a synced copy. Sign in to Google Authenticator on a new device with your Google Account. If your codes were synced, they should appear. Google also advises removing the lost device from your account.
3. Use your backup codes. If your codes were not synced, log in to each site with a saved backup code.
4. Contact account recovery.With no backup codes, use each site's recovery process. This can take time, and it is up to that site.
5. Set up two-factor again. Once you are back in, remove the old authenticator from each site and add a new one, this time with a backup.

Google Authenticator is a trademark of Google LLC. VaultKeep is not affiliated with or endorsed by Google.

Frequently asked questions