How to move 2FA to a new phone, and what to do if you lost the old one

1. Check which apps hold your codes. Many people have some in Google Authenticator and some in Microsoft Authenticator or Authy, and each moves separately.

2. Move them with each app's own method, below. An account that will not move can be set up again while you can still sign in: turn its authenticator-app 2FA off and on, or look for "change authenticator app". Our setup guides show where that setting is for 108 services — Google, Microsoft and GitHub among them.

3. On the new phone, sign in to your most important accounts with the new codes — your email first, because it is how every other account gets recovered.

4. Save fresh recovery codes for the accounts that matter, somewhere that is not the phone.

5. Only then erase the old phone. Keeping it in a drawer for a week costs nothing and saves you if one account was missed.

Google Authenticator. On the old phone open Menu → Transfer codes → Export codes, pick the accounts, and a QR code appears; on the new phone open Menu → Transfer codes → Import codes and scan it. If Google Account sync is on, signing in to the same Google Account on the new phone brings the codes over by itself, old phone or not. Without sync, the export QR code needs the old phone in your hand.

Microsoft Authenticator. Turn on cloud backup on the old phone — it uses a personal Microsoft account on Android and iCloud on iPhone — then recover from it on the new phone. The backup restores only to the same kind of phone: iPhone to iPhone, Android to Android. Codes for other services, such as Amazon or Facebook, come back as they were; for work or school accounts only the account name comes back, and you sign in to each one again. If that is not possible, your organization's help desk can clear your settings so you register the new phone at your next sign-in.

Authy. Authy accounts belong to a phone number. Install Authy on the new phone, enter the number, and approve the new device from the old one or by SMS or a call. Your tokens come across from the old device, or from Authy's encrypted backups if they were on — and those need your backup password, which Twilio never receives and cannot recover. Authy cannot export to another app, so leaving Authy means setting up each account again.

2FAS Auth. With 2FAS Backup on, its sync — Google Drive on Android, iCloud on iPhone — restores your tokens on a new phone of the same kind signed in to the same account. Between Android and iPhone, export a password-protected backup file on the old phone and import it on the new one. If you set a backup password, 2FAS cannot recover it.

2FA Authenticator (ours). It is not on your phone, so a new phone changes nothing for it. That makes it useful during a move: while the codes are in Chrome, you can sign in to each service on the computer and set up 2FA on the new phone without the old one. It cannot put codes into a phone app for you, though its export as otpauth:// links is a format almost any other authenticator can read (backup). To move it to another computer, use Chrome sync or an export file — see multiple devices and restore.

First, the honest part. A 2FA code is computed from a secret key stored in the app. If that key lived only on the lost phone, it is gone, and nobody can produce it again — not the app's maker, not a repair shop, and not us: 2FA Authenticator never receives anyone's secret keys. What can get you back in is the service you are signing in to. Work through these in order.

1. Check whether a copy survived. Google Authenticator with Google Account sync: install it on the new phone and sign in. Microsoft Authenticator with cloud backup: recover on a phone of the same kind. Authy with backups: install it, enter your number, verify by SMS or call, then enter the backup password. 2FAS with sync: turn on 2FAS Backup with the same Google or iCloud account. If you also added the accounts to 2FA Authenticator, the codes are still in Chrome on your computer.

2. Use the service's recovery codes. Most services hand out a set of one-time codes when you turn 2FA on. Google gives ten backup codes, each working once; GitHub calls them recovery codes. Enter one where the site asks for the 2FA code.

3. Try another sign-in method. A security key or passkey, a text message to a number you still have, or a prompt on another device that is still signed in. GitHub, for example, accepts a passkey or a security key in place of the lost app.

4. Ask the service for account recovery. It is slow on purpose. Google asks questions about the account, and it works best from a device and place you usually sign in from. Coinbase asks for a photo of your ID and takes up to 24 hours (Coinbase 2FA guide). A Microsoft work or school account goes through your organization's help desk. Some services cannot help at all: GitHub says its Support cannot restore access to an account with 2FA once both the 2FA credentials and the recovery methods are lost.

5. Lock the lost phone out. Google suggests erasing a lost phone remotely and, if your codes were synced, removing the device from your Google Account; without sync, it says to visit each site and set the codes up again. In Authy, remove the old device from your devices. Once you are back in an account, set its 2FA up again and save the new recovery codes.

Keep a second copy of every code. The simplest is two apps from the same QR code: when a site shows its setup QR code, scan it with your phone app and with 2FA Authenticator — both then show the same codes (multiple devices). Accounts already in Google Authenticator come across once through its export QR code.

Keep recovery codes off the phone. Print them, or keep them in a password manager. A screenshot in the phone's gallery is lost with the phone.

Turn on your app's backup, and keep its password somewhere else. Authy's and 2FAS's backup passwords cannot be recovered by the vendor.

Export a backup file now and then. In 2FA Authenticator: Settings → Export, protected with a password (backup); Import on another computer reads it back (restore). The extension's automatic daily copies live inside the extension — they protect against deleting an account by mistake, not against losing the computer.

Add a second way to sign in wherever a service offers one, such as a security key or a passkey.