How to Set Up Google Authenticator on a New Phone: 7-Step Transfer with a QR Backup and Lost-Device Fallback

The fastest way to move Google Authenticator to a new phone is the in-app Transfer Accounts feature, which requires both devices in hand on the same surface with the authenticator version that supports it (Android 2.3.0 or later, iPhone 4.0 or later, per Google's support documentation). It generates one QR code that carries every saved token to the new handset in a single scan. If the old phone is gone, cracked, or already factory-reset, that flow cannot run — and what happens next depends entirely on whether you saved backup codes for each service. The whole job takes about five minutes when both phones are available.

Exporting is not the same as the service reset. Google Authenticator holds the shared secret that generates your six-digit codes; removing the app, wiping the phone, or skipping the transfer doesn't disable two-factor authentication. The accounts still demand a code the new phone doesn't yet have. Plan the transfer before you retire, sell, or wipe the old device, and keep the old phone powered on until you've confirmed every account generates a working code on the new one.

Set the new phone's clock to automatic before you transfer anything

Time-based one-time passwords are derived from the clock on the device. If the new phone's clock is off by even a minute, every code it produces will be rejected as expired or not yet valid. On Android, open Settings > System > Date & time and switch on "Set time automatically." On iPhone, go to Settings > General > Date & Time and enable "Set Automatically."

Turn on automatic time zone detection as well. A traveler who manually set the phone to a different zone, then flew home, will generate codes for the wrong moment. Automatic settings pull from the carrier or network and fix both problems without you thinking about it.

Check the clock against a reference before you scan. Open time.gov in the phone's browser and compare the seconds. A drift over two seconds is enough to cause intermittent failures on strict services. If the phone can't hold sync, restart it and re-check; a persistent drift is a hardware or network problem to fix before the transfer.

Keep the old phone's clock on automatic too. If the old handset drifted, its codes may have been failing for weeks — a common reason people assume the app is broken. Fixing both clocks first means any failure after the transfer is a real transfer problem, not a hidden clock issue.

What you need in hand, including the version numbers that decide which method works

The app's transfer feature exists only in recent builds. Google's own support pages list Android 2.3.0 and iOS 4.0 as the versions with account transfer. Check the version in Google Play (Android) or the App Store (iOS) and update before you start. On an iPhone that's stuck below iOS 4.0 of Authenticator, there is no export; you'll fall back to resets or a service-specific migration path.

You need the old phone unlocked, the new phone fully set up with your Apple or Google account, and a stable connection on at least the new phone. The new device does not need internet for the scan itself if you install the backup code option, but you do need to be signed into the right app store account to install Authenticator.

Gather one recovery method per service before touching anything. That means the backup codes you downloaded when you enabled 2FA, or a second factor like a hardware key or SMS fallback that the service accepts. Printouts from years ago become the difference between a five-minute transfer and a week of account recovery.

Note how many accounts live in the app. The transfer screen shows the list; count it and write the number down. When the new phone finishes importing, that number is your check — a missing token is easier to spot before you wipe the old device.

The transfer method, step by step, for both phones in hand

Use this when the old phone still works and the app is current. It moves all accounts at once and leaves the old phone's entries in place until you remove them.

1: On the old phone, open Google Authenticator and tap the menu (three lines or dots, top right). 2: Tap Transfer accounts, then Export accounts. 3: Unlock with the phone's screen lock or biometrics; the app requires it before revealing secrets. 4: Select the accounts to move — tap each one, or select all — and tap Next. 5: A QR code appears. If prompted, tap Continue to reveal the full code. 6: On the new phone, install Google Authenticator, open it, tap Get started, then Scan QR code. 7: Point the new phone's camera at the old phone's screen; the accounts import automatically.

If the scan fails, tap the camera icon and retry, and increase the old phone's screen brightness to full — a dimmed display is the most common reason the code won't read. If accounts import but codes are rejected, recheck the new phone's clock before assuming the secret is wrong. If the export screen is missing entirely, the app version is too old; update and reopen.

After a successful import, test three services before deleting anything. Log in to your email, your bank, and one workplace tool with codes from the new phone. Then remove the accounts from the old phone through the same menu with Export accounts replaced by the removal option, or simply sign out of Authenticator on that device if you'll wipe it.

If the old phone is lost, stolen, or wiped, the backup codes are your only door

This is the edge case most guides skip. Without the old device, the in-app transfer cannot run, because the secrets live only on that phone (or in a cloud backup if you enabled one). Your only route is each service's own recovery flow, and the credential that makes it fast is the set of backup codes you saved when you switched on 2FA.

Google, Microsoft, Dropbox, GitHub, and most banks accept a one-time backup code in place of the authenticator code at login. Sign in, enter the backup code, and you're in. Then go to the security settings, disable the old authenticator, and re-enroll with the new phone — a fresh QR code per service. Some services let you re-enroll without disabling first if you're already signed in.

If the backup codes are gone too, you're in account recovery territory: identity verification, support tickets, and a delay measured in days rather than minutes. A bank may require a branch visit; an email provider may lock the account for a cooling-off period. The severity depends on the provider's policy, which is why the backup-code step belongs in every 2FA setup.

Some services offer an account-recovery code or a "trusted device" bypass. Check each provider's help center for "lost authenticator" and follow the listed path. Don't guess — a failed recovery attempt can trigger a security lockout that makes the real recovery slower.

Saving a QR backup is the step almost everyone skips

Google Authenticator has an option to save the export QR code as an image on the device. In the export flow, look for the save option before the code disappears. Screenshot it, then move it off the phone into an encrypted store — a password manager's secure note, an encrypted archive on a computer, or a printed copy in a safe.

Understand the risk before you do it. That image is equivalent to every secret in the app; anyone who gets it can generate your codes. Store it encrypted, never in a plain photo roll or an unencrypted cloud drive, and know that a shared family photo library counts as unencrypted for this purpose.

A second safeguard is a cloud backup of the app's data. Google's Authenticator supports syncing to a Google Account on Android, which survives a lost phone if you sign into the same account on the new one. Apple's version has historically not synced to iCloud, so iPhone users should rely on the QR save or the transfer flow; confirm the current behavior in the app's settings on your device.

Test the backup before you trust it. Do a dry run: export, save, then import the saved image on a second device or after a reinstall to confirm it works. A backup you've never restored is a hope, not a plan.

Cloud sync versus QR export: which migration path fits your situation, and the third option most people miss

There are three real migration routes, and they differ in what they require and what they risk. The table below compares them on the dimensions that decide the call.

The third option — per-service reset — is the one nearly every guide omits until it's too late. It's slower and needs the backup codes, but it works when nothing else does, and it's the only path that doesn't depend on either phone.

Pick the QR scan when both devices are present and the app is current. Pick sync if you're on Android and have already enabled it. Pick per-service reset when the old phone is gone. If you're switching platforms — Android to iPhone or back — the QR transfer still works, but cloud sync does not follow you across ecosystems, so rely on the QR path or the per-service reset.

Platform differences: what changes between Android and iPhone

The menu labels differ slightly and so do the backup behaviors. On Android, the menu is the three-line icon; on iPhone, it's typically the three-dot icon, and the export flow uses the share sheet to save the QR image. The steps are otherwise identical, which is why a single walkthrough covers both.

Android's Google Account sync is the bigger divergence. Signing into the same Google Account on a new Android phone can restore Authenticator entries automatically, without a scan. Turn it on in the app's settings ahead of time if you want that safety net. On iPhone, no equivalent iCloud sync exists for Authenticator as of Google's current documentation, so the QR save or transfer is the only migration route.

Screen scanning behavior differs too. iPhone cameras tend to lock onto a QR code from farther away, while some Android cameras need the code to fill more of the frame. If the first scan fails on Android, move the old phone closer and hold still for a second.

Test the transfer direction before a real move. Export one account to a spare device or a fresh install, confirm the code works, then delete it. A five-minute rehearsal on a low-value account teaches you the menu path and the camera quirks without risking your primary logins.

After the move: verify, clean up, and close the old device's exposure

Test more than one account, and test on a device that isn't the new phone. Open a laptop, log in to a service, and enter the code from the new handset. That removes the phone itself from the loop and proves the secret, not just the app's display, is correct.

Remove the accounts from the old phone or wipe it. If you're selling or recycling the device, a factory reset is the minimum; if the app synced to a cloud account, sign out of that account on the old device as well, or the next owner could inherit access. On Android, removing the Google Account from the device before a reset prevents the sync from re-importing.

Regenerate backup codes for your most important accounts. The ones you saved years ago may have been used, shared, or printed on paper that's now gone. Log in to each service's security settings and download a fresh set, storing it separately from the phone.

Set a calendar reminder for a periodic review — every six months is plenty — to confirm the app still opens, codes still work, and backup codes are current. The transfer you do today is only as good as the recovery plan behind it.

The mistakes that turn a five-minute transfer into a week of account recovery

The first mistake is wiping the old phone before testing the new one. A factory reset destroys the secrets instantly, and if the import silently missed an account, you find out at the worst moment. Wait until three logins succeed.

The second is trusting a screenshot in the camera roll. Photo libraries sync to cloud services, share with family accounts, and survive on devices you've forgotten about. An unencrypted QR image is a standing invitation.

The third is assuming the service disabled 2FA when you deleted the app. It didn't. The account still expects a code, and the provider's recovery flow is now your only route — which loops back to the backup codes.

The fourth is skipping the clock check. A new phone restored from a backup can carry an old time setting, and every code it makes will be rejected. Automatic time is a one-switch fix that prevents a confusing hour of troubleshooting.

The fifth is transferring on the day you sell the old phone. Do it a week early, test, and keep the old device as a fallback until the new one has proven itself across your most important accounts.

FAQ

Does moving to a new phone turn off two-factor authentication?

No — the account keeps requiring a code. Authenticator stores the shared secret locally, so a missing secret means the service still challenges you but you can't answer. That's why the transfer or a backup code has to happen before the old phone leaves your hands.

Can I transfer accounts if I already factory-reset the old phone?

Not through the app, because the secrets are gone with the data. You'll need each service's backup codes or recovery flow, one account at a time. Recovery time varies by provider — some finish in minutes, banks can take days.

Why does my new phone's code get rejected right after transfer?

Check the clock first. A new device with a manual or drifted time setting generates expired codes, and the fix is one switch in Date & Time settings. If the clock is correct, confirm the account was fully imported and not just partially scanned.

Is saving the QR code image safe?

Only if it's encrypted and kept off shared photo libraries. The image can generate every code in your app, so treat it like a master key: password manager, encrypted archive, or a printed copy in a safe. Never leave it in a cloud-synced camera roll.

Do Android and iPhone transfers work the same way?

The menu path and scan flow are identical; the backup options differ. Android can sync to a Google Account so a new phone restores automatically, while iPhone has no equivalent iCloud sync, making the QR save or manual transfer the reliable route.

What if I'm switching from Android to iPhone?

The QR transfer works across platforms because it moves the secrets, not the app data. Cloud sync won't follow you, so export first and keep the QR image as your fallback until every account is verified on the iPhone.

How many accounts can one transfer carry?

The export screen moves every selected account in a single QR code, including large lists. If the code fails to scan, the usual causes are screen brightness, camera distance, or a partially obscured display — fix those before re-exporting.

Should I keep the old phone after the transfer?

Keep it powered off but intact for a week or two as a fallback, then wipe it before selling or recycling. Sign out of any synced cloud account first, or a restore could re-import the old secrets onto a device you no longer control.