Move Google Authenticator codes to your browser

Google Authenticator on a phone can export its accounts as QR codes, up to 10 accounts on each. OTP.pink reads those codes as pictures, so the accounts move together instead of setting 2FA up again on each site.

What has been checked

• Checked on a real export: two full pages of 10, 20 accounts with codes that change every 30 seconds. Every account came across, and the codes in OTP.pink matched the phone.
• The way back: the QR pages that OTP.pink shows were scanned by Google Authenticator, and the codes matched.
• Not yet checked on a real export: an export of a single page, accounts that use SHA-256 or SHA-512, 8-digit codes, and counter-based (HOTP) accounts. They are read by the format’s description: if you move one of them, compare its code with the phone before you rely on it.

The steps

Described for Chrome; in Edge and Firefox, the Import and export drawer has not been checked yet.

1. On the phone, open Google Authenticator: Transfer accounts → Export accounts, and choose the accounts to move. The app shows a QR code for each group of up to 10 accounts. The menu may be named a little differently in your version of the app.
2. Get each QR onto the computer as a picture. Every page is needed. Prefer a way that leaves no copy elsewhere: not a chat, mail, cloud storage or photo sync, where deleting the picture may not reach its backups.
3. Add each picture to OTP.pink: paste it into the panel with Ctrl+V, or drop the file in Import from another app, under Import and export in the panel’s header.
4. Until every page is in, the panel says how many it has read — “2 of 3” — and which page numbers are missing. Add the rest the same way. If the panel locks before the last page, the pages read so far are dropped: add them again from the first.
5. Check the list and add. Once the last page is read, the panel shows every account it found. Accounts already in the vault come unchecked: leave them so, and the same export run a second time adds nothing twice. Check one only if you want it twice.

Check every account

Compare one code per account with the phone before you rely on it. Better to find an account that did not come across now than at your next sign-in.

Delete the export afterwards

Each export QR holds the secret keys of its accounts unencrypted: anyone with the picture can make your codes. When the move is done, delete the photos and screenshots of the QR codes, and any copy a transfer left behind anyway: in a chat, a cloud folder, cloud photo backup.

The accounts on the phone

OTP.pink imports a copy of each account and cannot remove anything from the phone. Time-based accounts left in the app keep showing the same codes as the browser. A counter-based (HOTP) account counts on each side separately, so the two copies drift apart once either is used: keep using it in one place only. If you mean to leave the phone, remove them there only after every code in the browser has been checked.

Leaving again

The way out is the same: Import and export → Unencrypted export → the format Google Authenticator shows the accounts as QR pages for the app to scan. An account the format cannot hold — a Steam one, say — is named with the reason instead of being changed into something else.

Right after the move, keep an encrypted .pinkotp file: see backups. Other ways to add an account are on adding accounts.