Support

1. 1Open Google Authenticator on your phone.
2. 2Tap the ⋮ menu (top right) → Transfer accounts → Export accounts.
3. 3Pick the accounts and tap Next. Your phone now shows a QR code.
4. 4In the extension, choose Scan QR with camera and point your computer's camera at the phone screen.

No camera on your computer? Photograph the QR code with another device, send the picture to your computer, and use Add Account → QR Code → Choose Image instead.

One QR code can carry several accounts at once — Google Authenticator exports them in a batch, and we import the whole batch in one go.

Usually the code itself is fine — it belongs to a different QR code than the one the website is waiting for. The extension checks the time on its own, so there is nothing to change on your computer. What usually happened:

1. The website made a new QR code. It does that whenever its setup page is reloaded or opened again, and the account you added first stops matching. Start the setup on the website again, add the QR code that is on the screen now, and type its code in straight away.
2. The code came from another entry. If the same website is in the list twice, the newest entry is the one that works — and during setup the website wants the code of the account you just added.
3. Two-factor was already set up somewhere else, such as an app on your phone. The extension shows codes only for accounts added to it. To move that account here, set up the authenticator on the website again, this time with the extension.
4. The website wants a different code — one it sent you by text message or email, not one from an authenticator app.

Before you delete an old entry, export a backup first. And if the extension itself shows a warning about the time, do what it says.

Check first whether your app can export — many can, and some of them write out a plain list of otpauth:// links. That list is the fastest way across: open Settings → Paste links and paste the whole thing at once. A .txt file of the same links goes through Import instead. Either way it is one action, not one per account.

If your app genuinely refuses to export, then it is one service at a time:

1. 1On the service's website, turn two-factor authentication off.
2. 2Turn it straight back on. It shows you a new QR code.
3. 3Add that QR code here.

Do one service at a time, and keep the old app installed until you have checked that a code from here is actually accepted. Deleting the old app first is how people lock themselves out.

Use the recovery code you saved when you turned password protection on: open the extension, click Forgot your password? on the lock screen, enter the code and choose a new password.

If you have neither the password nor the recovery code, the accounts cannot be recovered — not by you and not by us. There is no master key and no server-side copy; that is what makes the encryption meaningful. You would need to turn two-factor authentication off and on again on each service, using their own recovery codes to get in.

If you have a backup file, use Settings → Import and choose it. Password-protected backups will ask for that password.

If you did not export one, the extension keeps automatic local snapshots of the last seven days — they survive an accidental deletion, but not uninstalling the extension or wiping the browser profile.

To have accounts appear on a second computer, sign both Chrome browsers into the same Google account and leave Settings → Sync across devices switched on.

Your license key is in the email you received after paying. Lost it? Open the extension on the computer where you need it and go to Settings → Pro → Get Pro → Restore a purchase, then enter the email address you paid with: the key is sent there again. On another computer, enter it under Settings → Pro → I have a license key.

To change your payment method or cancel, use Settings → Pro → Manage subscription; after you cancel, Pro stays on until the end of the period you paid for. For anything about a charge or a refund, or if the email with your key never arrives, write to support@authenticator.sh from the address you paid with. What Pro includes is on the Pro page.

Write to support@authenticator.sh and tell us what you would use it for. A person reads every message, and what people ask for most is what we build next.

Please do not send vulnerability reports to the support address — that inbox is not treated as confidential. Write to security@authenticator.sh instead. Our security policy sets out scope, response times and safe-harbour terms.

Write to support@authenticator.sh. It helps to include your browser version and what you were doing when it went wrong.

Never send us a secret key, a QR code image or a backup file. Anyone holding those can generate your codes, and we have no need for them to help you.

Curious how the extension works under the hood? See How it works, and Privacy for what is stored where.