How to Move Your Google Authenticator Codes to Aegis

Short answer: in Google Authenticator, tap Menu › Transfer codes › Export codes, pick the accounts and tap Next. In Aegis, tap the + button, choose Scan QR code and scan each code Google Authenticator shows, in order. Nothing changes on the websites you log in to: Aegis produces the same codes.

Why the websites don’t notice

The codes in an authenticator app are almost always TOTP codes (a few services use counter-based HOTP codes, which move the same way). Each one is calculated from a secret that the website gave you when you turned on two-factor login, combined with the current time. The standard behind them, RFC 6238, requires the app and the website to “share the same secret”, and by default a code lasts 30 seconds. Move the secret to another app and that app produces the same codes, so you don’t have to set up two-factor login again on each site.

The other side of this: the export QR codes contain those secrets. Aegis’s source code shows what Google Authenticator puts in them: an otpauth-migration://offline?data=… link whose data holds each account’s name, issuer and secret. Anyone who can scan or photograph the codes can produce your login codes. When Google introduced the export in 2020, it wrote that “no data is sent to Google’s servers during the transfer” and that the secrets “can’t be accessed without having physical access to your phone and the ability to unlock it”. A screenshot of the codes is a copy outside that protection, so handle any you take with care (see Step 2).

Before you start

• Install Aegis and finish its setup first. You can’t import from Google Authenticator on the setup screens; Aegis’s wiki: “In the initial setup screen, you can only import Aegis vault exports/backups.”
• Set a password you won’t forget. With a password, Aegis encrypts its vault (AES-256-GCM), and biometrics can unlock it as well. Aegis lets you skip the password but calls that “not recommended”, and without one, automatic backups aren’t available. Its warning about the password itself: “If you forget your password, you will permanently lose access to your tokens. There is no way to recover them without the password.”
• Leave automatic time on. Codes depend on the clock. Aegis warns you if automatic time sync is off, because “A deviation of only a few seconds could result in incorrect codes.”
• Don’t delete anything from Google Authenticator yet. That is our advice, not a step from Google or Aegis: keep the accounts until you have checked them in Aegis (Step 3).

Step 1: Export from Google Authenticator

Google’s steps for Android:

1. In the Authenticator app, tap Menu › Transfer codes › Export codes.
2. Unlock the phone when asked.
3. Select the accounts you want to move and tap Next.

Google: “If you transfer more than one account, your old device may create more than one QR code.” Older versions of the app, and the iPhone app, call the option Transfer accounts › Export accounts.

Step 2: Bring them into Aegis

With the camera (Aegis on a different phone from Google Authenticator):

1. In Aegis, tap the + button on the main screen and choose Scan QR code.
2. Scan the codes in order, starting with the first. After each one Aegis shows how far it is, for example “Scanned 1/3 QR codes”. A code scanned out of order is refused with an “Expected QR code…” message; scan the next one in sequence instead. Start with the first for a reason: Aegis’s source code accepts whichever code you scan first and finishes at the last one, so starting with the second would leave out the accounts in the first.
3. After the last code, Aegis adds the accounts to its vault (“Added 12 new entries to the vault”). With a single account, it opens the entry for you to save.

From screenshots (both apps on the same phone, where the camera can’t see the screen):

1. Take a screenshot of each QR code.
2. In Aegis, tap + and choose Scan image, then select all the screenshots together. If one is missing, Aegis warns that “Some QR codes are missing from your import” and recommends retrying with all of them.
3. Use Scan image, not Settings › Import & Export › Import from file. One of Aegis’s developers explained that importing a screenshot through the “Import file” wizard “doesn’t work”.
4. Delete the screenshots when you are done, including any copies your photo app has backed up.

If Aegis can’t read a screenshot, its developers say the QR library they use “can be a bit hit or miss in certain situations when scanning from images”, and suggest cropping the image to just the QR code, leaving some space around it. Showing the codes on another screen and scanning them with the camera is the other way round it.

Step 3: Check, then clean up

Open an account in both apps at the same moment: the codes should match. When they do for every account, log in to one or two of the sites with a code from Aegis. Only then remove the accounts from Google Authenticator.

If you signed in to Google Authenticator with a Google Account, it syncs your codes to that account. Google’s help page says it encrypts them “both in transit and at rest” and offers a way out: tap your profile picture, then Use Authenticator without an account, which “will remove codes from all of your Google Accounts and store them on your device”. Remove them from the app after that.

What doesn’t move this way

• Only what is in Google Authenticator. Codes sent by SMS, sign-in prompts on another phone, and passkeys aren’t stored in Google Authenticator, so there is nothing to move.
• The old root method no longer works for current versions. Aegis can also read Google Authenticator’s database directly with root, but only “database files from Google Authenticator v5.10 and prior are supported”. An Aegis developer explained that Google Authenticator then started encrypting its entries, and that “the only option now to import Google Authenticator tokens is to use the ‘Transfer’ method”.

After moving: back up Aegis

Aegis doesn’t go online at all. Its FAQ: “Aegis doesn’t have access to the internet and we don’t have plans to change this.” There is no account to restore from, so backups are up to you, and they are off by default:

• Automatic backups (Settings › Backups) write a copy of the vault to a folder you choose whenever something changes, keeping the last 5 by default. They are “only supported for encrypted vaults”, so you need a password set.
• To get backups off the phone, Aegis’s FAQ says a cloud app works if it is installed and “fully participates in the Android Storage Access Framework”, and names Nextcloud (our Nextcloud page); or let a sync app copy the backup folder elsewhere.
• Android cloud backups are a separate setting, also off by default and also only for encrypted vaults. Moving directly from one phone to another with Android’s own transfer is always allowed: “Device-to-device (D2D) backups are always allowed, regardless of the setting above”.
• Manual export (Settings › Import & Export › Export) can produce an encrypted Aegis file. The HTML and text formats can’t be encrypted, and Aegis makes you confirm before writing an unencrypted export.

Moving back, or on to another app

Aegis has an Export for Google Authenticator option that shows QR codes in Google Authenticator’s own format, ten accounts per code. Its note: “only TOTP & HOTP tokens that use SHA1 and produce 6-digit codes are included”. Scan them in Google Authenticator with Transfer codes › Import codes. Other apps that can import Aegis’s exported file, or a text list of otpauth:// links, can take the accounts from there.

Common questions

Do I have to set up two-factor login again on each website? No. The secret is what matters, and it moves with the QR codes, so Aegis shows the same codes Google Authenticator did.

Can I keep the accounts in both apps? Yes; both will show the same codes. Each copy of the secrets is one more thing to protect, so most people remove them from the old app once the new one works.

Aegis found only the first QR code in my screenshots. Select all the screenshots in one go with Scan image, crop each one to the QR code with a margin, or scan the codes with the camera from another screen.