To move authenticator apps to a new phone, go account by account instead of assuming a phone backup copied every two-factor credential. For Google Authenticator, sign in to the same Google Account on the new phone so codes sync, or use Transfer codes > Export codes on the old phone and scan the QR with Import codes on the new one; Microsoft Authenticator restores from its own backup only to the same device type, and accounts that do not move need re-enrollment. First inventory the accounts and backup sign-in methods, and keep the old phone until every important account has been tested from a signed-out state.

Key Takeaways

Secure recovery methods before touching the old authenticator.

Google Authenticator sync and manual export are different paths; know which one you use.

Microsoft Authenticator backup restores only to the same device type, and some accounts still require re-registration.

Never place a QR code, setup secret, recovery code, or live one-time code in screenshots, notes, logs, tickets, or test fixtures.

This guide covers authenticator continuity, not the rest of a phone migration. Use the iPhone transfer or Android transfer guide for general data. For broader device help, see the Device and App Guide.

Google defines Authenticator sync, export, and lost-device behavior［1］; its backup-code guide defines the one-time fallback［2］; Microsoft documents backup preparation［3］; and its restore guide defines same-device-type and account-specific limits［4］.

Build an account inventory first

List the services shown in the old authenticator without copying their live codes. For each service, record only safe administrative facts:

service name and account identifier;
whether another sign-in method already works;
whether recovery codes exist in an approved secure location;
whether a security key, passkey, trusted device, or backup phone is enrolled;
whether an employer, school, or client administrator controls re-enrollment; and
whether the account is high impact, such as primary email, password manager, finance, cloud, source control, or domain administration.

Test a backup method for the highest-impact accounts before migration. Google describes backup codes as one-time alternatives when the normal second step is unavailable; creating a new set invalidates the old set. Do not expose the codes while checking that they exist.

Which path can you use to move authenticator apps to a new phone?

Path	Appropriate when	Main risk
Account-backed sync	The authenticator explicitly syncs entries to the account you control	Signing into the wrong account can make entries appear missing
Export and import	The old phone works and the authenticator officially supports local transfer	The displayed transfer QR is sensitive and must not be saved in photos, recordings, or logs
Backup and restore	The app documents a compatible backup for the same platform or device type	A restored account name may still need verification or re-registration
Per-account re-enrollment	Sync or restore is unavailable, cross-platform, or administrator-controlled	Removing the old method too early can lock out the account

Do not use an unofficial “authenticator transfer” app, export a database into ordinary cloud storage, or copy setup secrets into a chat message.

Transfer Google Authenticator

If you sign in to a Google Account inside Google Authenticator, Google says codes can synchronize to the new device after you sign in to that same account. Confirm the account identity rather than assuming an ordinary phone restore performed the sync.

If you use Google Authenticator without a Google Account, use its manual transfer flow:

install the current Google Authenticator on the new phone;
on the old phone, open the menu, tap Transfer codes, and choose Export codes;
unlock the old phone, select the accounts, and tap Next; a large selection can produce more than one QR code, so scan each one;
on the new phone, open Transfer codes, choose Import codes, and scan the transfer QR directly; and
keep that QR out of screenshots, screen recordings, shared rooms, logs, and support tickets.

The old entries may remain after import. Do not delete them until the new phone has passed account-by-account sign-in tests. Be especially careful with synchronized entries: Google notes that deleting a synchronized code can remove it from every device using that synced account.

Restore Microsoft Authenticator carefully

Microsoft's backup and restore has strict boundaries:

backup and restore must use the same device type; an iOS backup cannot be restored on Android, and an Android backup cannot be restored on iOS;
Microsoft personal accounts with passwordless sign-in may restore only the account name and require sign-in again;
work or school accounts restore only the account name and require sign-in or re-registration;
third-party time-based code accounts may restore their codes, but they still need testing.

Turn on backup on the old phone before relying on it. On Android, the Cloud Backup setting stores the backup with a personal Microsoft account; on iPhone, the backup depends on iCloud Drive, iCloud Keychain, and iCloud Backup being turned on.［3］ Microsoft also says that from January 2027, Android backup will be enabled through Google One backup instead of a Microsoft personal account, so check the current setting name before you start.［3］

On a new Android phone, choose Begin recovery or Restore from backup before adding unrelated accounts and sign in with the same recovery account; on a new iPhone, turn on the same iCloud settings first. Then complete every “Sign in to restore” or “Action required” prompt.［4］

For work or school accounts, follow the organization's enrollment policy. If an administrator must reset MFA registration or approve a new device, stop and contact them before removing the old method.

How do you re-enroll accounts that did not move?

Use a trusted session, backup method, security key, or recovery process to open the service's security settings. Add the new authenticator, test it, and only then remove the old authenticator entry for that service.

If you have no working recovery method, do not guess, disable protections, or ask someone to send a setup secret. Use the service's official account-recovery or administrator path. High-impact accounts should be recovered before lower-priority services.

Test every account before removing the old phone

For each service:

open a private browser window or fully sign out;
sign in with the normal username and password or passkey;
complete the second step using the new phone;
confirm that a backup method also remains available;
inspect the service's registered devices or authentication-method list; and
record only a pass/fail result—never the code used.

Repeat this for primary email, password manager, Apple or Google account, Microsoft account, finance, work, cloud, developer, and domain-administration services. Only after all required tests pass should you remove the old authentication method, wipe the old phone, or return it.

What if the old phone is lost or broken?

Use a recovery code, security key, passkey, trusted device, backup phone, or official account recovery. For an organization-managed account, contact the administrator. Google advises removing a lost device from the account when codes were synchronized; when they were not synchronized, each service must be visited and relinked individually.

After recovery, review recent sign-ins and registered methods, revoke the lost device where supported, and replace any recovery material that may have been exposed.

Summary

There is no universal authenticator migration. Inventory accounts, secure recovery options, apply the provider's supported method, and test every account before removing the old phone. Treat every QR code, setup secret, recovery code, and one-time password as a credential throughout the process.

Frequently asked questions

Does a phone backup move authenticator codes?

Do not assume it does. Authenticator apps use different sync, export, backup, and re-enrollment contracts. Verify the app's official method.

Does Google Authenticator sync automatically?

It can synchronize codes when you sign in to the same Google Account in the app. Without an account, use the app's manual export/import flow.

Can I screenshot the Google Authenticator transfer QR?

No. Scan it directly between controlled devices and keep it out of photos, recordings, cloud galleries, logs, tickets, and messages.

Can Microsoft Authenticator restore from iPhone to Android?

No. Microsoft says backup and restore work only on the same device type, so switching platforms means re-enrolling each account on the new phone.

Why does a restored Microsoft work account say action required?

Work or school accounts generally restore only the account name. You must sign in or re-register, sometimes with administrator approval.

Should I delete codes from the old phone after import?

Only after each account works on the new phone. With synchronized Google Authenticator entries, deletion can affect every synced device.

What if I have no recovery codes?

Try another enrolled method such as a security key, passkey, trusted device, or backup phone. Otherwise use the service's official recovery or administrator process.

What should I do if the old phone is lost?

Recover each account with an existing backup method, revoke the lost device, review sign-ins, and re-enroll the new authenticator. Unsynced accounts may need individual recovery.

Authenticator behavior varies by app, platform, account type, organization, and policy. Never expose setup QR codes, secret seeds, recovery codes, or live one-time passwords.

Sources

Sources checked 4 October 2026.

How to Move Authenticator Apps to a New Phone Safely