How to Back Up Your Authenticator App (Before You Lose Your Phone)

Short answer: You need two independent backups. First, back up the app — either cloud sync (2FAS, Ente, Microsoft Authenticator, Google Authenticator) or an encrypted export file (Aegis, 2FAS, Bitwarden). Second, save each service’s own backup codes offline, because they get you in even if the app is gone entirely. The one moment you cannot recreate later is setup: while a QR code is on screen, scan it into two devices.

The thing that actually goes wrong

Almost nobody loses their 2FA to an attacker. They lose it to a dropped phone, a factory reset, a stolen bag, a failed upgrade, or an app deleted during a cleanup.

And the failure is silent until it is total. Your codes work fine every day, right up to the moment the device holding them is gone — and then you discover that the same second factor protecting your accounts is now locking you out of them. Email, bank, exchange, work systems, all at once.

Backing up takes about twenty minutes. Recovering without one takes days per account, sometimes weeks, and occasionally never.

Layer 1: Back up the app itself

How you do this depends on your app. Two broad approaches:

Cloud sync (automatic, hands-off)

• 2FAS — backs up to iCloud or Google Drive; enable it in settings and set a backup password.
• Ente Auth — end-to-end encrypted sync across all platforms via an Ente account.
• Microsoft Authenticator — cloud backup tied to a Microsoft account (iOS also uses iCloud).
• Google Authenticator — syncs to your Google account when signed in.
• Authy — encrypted multi-device backups with a separate backup password.
• Password managers (Bitwarden, 1Password, Proton Pass) — TOTP entries are part of your vault and inherit its sync. Trade-offs discussed in password managers with built-in TOTP.

The catch: your recovery now depends on retaining access to that cloud account — and if it is the same account your authenticator protects, you have built a circular dependency. Make sure you can get into your Google or Microsoft or Apple account by some route that does not require the authenticator you are backing up.

Encrypted export files (manual, fully under your control)

• Aegis — encrypted vault export, with an option to write a backup automatically to a folder on every change. Set this up; the manual-only version is the app’s weak spot.
• 2FAS — password-protected export file alongside its cloud option.
• Google Authenticator — Transfer accounts → Export produces a QR code containing your tokens. See transferring Google Authenticator to a new phone.

Store the export file somewhere that survives losing the phone — a laptop, an encrypted USB drive, a cloud folder — and remember the password protecting it. An export you cannot decrypt is not a backup.

Aegis and 2FAS are compared in detail in Aegis vs 2FAS.

Layer 2: Save each service’s backup codes

App backups protect you against losing your phone. Backup codes protect you against everything else: a corrupted export, a forgotten backup password, an app that will not restore, or a service that has changed its 2FA system.

Most major services — Google, GitHub, Facebook, Instagram, Coinbase, Binance, Dropbox — issue a set of single-use codes when you enable 2FA. LinkedIn and X issue one. Amazon and TikTok issue none, which makes their recovery contact details more important.

Store them printed on paper somewhere physical, or in an encrypted vault you can reach without your phone. Never in a camera roll that syncs to the cloud, never in a plain-text note, never emailed to yourself. Our guide to where to store 2FA backup codes ranks the practical options.

Layer 3: The trick that only works at setup

While a service’s QR code is on screen during setup, scan it into two devices — your phone and a tablet, or two different authenticator apps.

Both will then generate identical codes forever, independently, with no sync, no export file and no cloud account involved. It is the cleanest backup that exists, and it costs ten seconds.

The catch is that it only works then. Once you close that page, the secret is gone and your options narrow to backup codes or disabling and re-enabling 2FA on the account. If you are setting up something important today, do this. If you want the same effect for accounts you have already enrolled, our guide to setup keys and manual entry explains how the key works.

A 20-minute plan you can do today

1. Turn on your app’s backup. Open its settings and confirm cloud backup is on, or run an encrypted export. Check a file was actually produced.
2. List your critical accounts. Email first, then bank, then anything with money in it, then work systems. Usually five to ten.
3. Generate fresh backup codes for each and save them in one place, offline.
4. Break the circular dependency. Make sure you can access the cloud account holding your backup without the authenticator it is backing up. A recovery code or trusted device is enough.
5. Add a second factor to a second device for your top two or three accounts, by disabling and re-enabling 2FA and scanning the new QR into both. Slightly tedious, worth it for email.
6. Diary a check. Once a year, confirm the backup still runs and you still know the password.

Testing a backup without breaking anything

An untested backup is a hope, not a plan. Two safe tests:

• Restore to a spare device — install your app on an old phone or tablet and restore. If the codes match your main device, the backup works. Wipe the spare afterwards if you are not keeping it.
• Check one backup code — log into one account using a backup code rather than an app code. It will consume that code, but confirms your saved set is the current one. Services usually let you regenerate afterwards.

Do not test by deleting the app. That is not a test, that is the incident.

Frequently asked questions

Is it safe to back up 2FA codes to the cloud?

With a reputable app, yes — the backup is encrypted on your device before upload, so the provider stores ciphertext. The risks are a weak backup password and the circular dependency described above, not the cloud itself.

What if I already lost my phone with no backup?

Work account by account using backup codes, alternative verification methods, and support recovery. Start with your email, because it unlocks the reset paths for everything else. Our step-by-step guide is recovering accounts after losing your 2FA phone.

Can I just screenshot the QR codes?

Please don’t. Screenshots sync to cloud photo libraries, get shared accidentally, and sit unencrypted on your device. Anyone who obtains one owns your second factor permanently and invisibly. Scan into two apps instead, or keep an encrypted export.

Do I still need backup codes if my app syncs to the cloud?

Yes. They protect against a different failure — losing access to the cloud account, forgetting the backup password, or a restore that does not work. Two independent layers, two different failure modes.

How often should I refresh backup codes?

When you use one, when you suspect exposure, and otherwise once a year during a general security check. Regenerating invalidates the old set, so replace your stored copy at the same time.

Should I keep a printed copy?

For your most important accounts, yes. Paper does not get ransomwared, does not need a charger, and does not depend on remembering a password. Keep it somewhere you would keep a passport, not on a desk.

The bottom line

Two layers, one habit. Turn on your app’s backup, save each service’s codes offline, and whenever you set up a new account, scan the QR into a second device before the page closes. Twenty minutes now against a week of support tickets later — and the accounts you would be fighting to recover are the ones you cannot do without.

Not sure your current app has a good backup story? Compare the options in the best Google Authenticator alternatives, or on iPhone, the best 2FA apps for iPhone.