What is a Google Authenticator export?

Google Authenticator never shows you the secret behind a code. To move accounts to a new phone it has "Transfer accounts", which shows one or more QR codes. Each code holds a link like otpauth-migration://offline?data=..., and the data part is a Base64 protobuf message with every account in it: the secret, the account name, the issuer, the algorithm, the number of digits and the type.

Some apps, such as Aegis, can import these codes, but most password managers and authenticator apps want the usual otpauth:// link or the Base32 secret, one per account. That's the reason to decode the export: it's the only way to get your secrets out of the app.

Tool description

Paste the otpauth-migration:// link, or upload a screenshot or a photo of the QR code, and the tool lists the accounts inside it with their issuer, account name, type (TOTP or HOTP), algorithm and digits. Click an account to get its Base32 secret and its otpauth:// link, both ready to copy, and a QR code you can scan into another app.

When the export is split over several QR codes, the tool tells you which part you decoded, so you know to decode the others too. If your phone won't let you take a screenshot of the export screen, take a photo of it with another device.

Everything is decoded in your browser. The link, the image and the secrets never leave your device.

Examples

This export link holds one account:

otpauth-migration://offline?data=CjEKCkhlbGxvId6tvu8SGEV4YW1wbGU6YWxpY2VAZ29vZ2xlLmNvbRoHRXhhbXBsZTAC

The tool shows the issuer Example, the account Example:alice@google.com, TOTP, SHA1 and 6 digits, the secret JBSWY3DPEHPK3PXP and this link:

otpauth://totp/Example:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example

Features

  • Reads the export link or a picture of its QR code
  • Base32 secret and otpauth:// link for every account
  • A QR code per account to scan into another authenticator app