Authenticator app on a new phone: how to move 2FA codes without getting locked out

What actually moves when you switch phones?

What moves is a set of secret keys, one per account, not the codes themselves. An authenticator app is an app that turns each secret key and the current time into a new 6-digit code every 30 seconds, using the TOTP (time-based one-time password) standard.

The secret key is created once, when you first scan a QR code on the website's two-factor setup page. If that secret does not reach the new phone, the new app cannot produce valid codes, no matter how many times you reinstall it.

That is why lockouts happen. People wipe or trade in the old phone, open the app on the new one and find it empty. If you need a refresher on how this second step fits into sign-in, see what two-factor authentication is and how it works.

What should you do before you touch the new phone?

Before you touch the new phone, make a list of every account that uses your authenticator app and save fresh backup codes for each one. This takes the most time, but it is the step that makes the rest safe.

1. Open the authenticator app on the old phone and write down every account it holds, including old work tools you rarely open.
2. For each account, sign in on a computer, open its security or two-factor settings and download or view the backup (recovery) codes. Generate new ones if you cannot find the old set.
3. Store the codes somewhere you can reach without either phone: a password manager, or a printed sheet kept somewhere safe.
4. Check which accounts are shared with colleagues. Those need a plan of their own (covered further down).
5. Charge the old phone and keep it. Do not factory reset it, trade it in or remove the app yet.

Backup codes are single-use codes the website gives you to sign in when you cannot produce a 2FA code. Each one works once, so cross it off when you use it.

How to set up an authenticator app on a new phone

To set up an authenticator app on a new phone, install the same app (or a new one), move the secrets across with a transfer, sync or re-enrolment method, then test every account before retiring the old phone. Which transfer method you can use depends on the app.

Export and sync options differ between apps and change over time, so check your app's own help page for the exact menu names. Whatever the method, the goal is the same: every account on the old phone appears on the new one and produces codes the website accepts.

How do you check the move worked before wiping the old phone?

You check the move by signing in to each account with a code from the new phone, not just by seeing the account name in the app. An account can appear in the list and still produce wrong codes if the transfer was incomplete.

• Sign out of each account on one browser, then sign back in using the new phone's code.
• Compare the codes on both phones side by side; they should match for the same account at the same moment.
• If codes are rejected, check that the new phone's date and time are set automatically. TOTP codes depend on an accurate clock.
• Tick each account off your list. When every line is ticked, remove the accounts from the old phone and reset it.

What if the old phone is lost, broken or already reset?

If the old phone is gone, sign in with a saved backup code and set up two-factor again on the new phone. This is the situation backup codes exist for.

Without backup codes, your options depend on each service. Many offer an account recovery process, a backup phone number or an email fallback, and some require identity checks that take days. Start with the accounts you need most, such as email and banking, because recovering your email often unlocks the rest.

Once you are back in, generate new backup codes, because the old set may have been on the lost device or in a photo on it.

Why shouldn't shared business accounts live on one person's phone?

Shared business accounts should not live on one person's phone because the whole team loses access whenever that phone is replaced, lost or leaves with its owner. A phone upgrade that is a minor chore for one person becomes a lockout for everyone who uses the company's social media, ad, domain or banking logins.

The common pattern is an account set up years ago by whoever was at the desk that day. Their phone holds the authenticator secret, colleagues message them for codes, and nobody notices the risk until they go on holiday, switch phones or resign. The same problem shows up during employee offboarding, when the leaver's phone turns out to hold 2FA for half the company's tools.

For team accounts, the safer pattern is:

• Keep the TOTP secret in a team vault that more than one trusted person can reach, so codes do not depend on a single device.
• Store the backup codes next to the login, not in one person's downloads folder.
• Record who holds 2FA for each login, so a phone change or departure is planned rather than discovered.

The guide on how to share 2FA codes with your team covers this in more detail, including accounts that still use SMS codes.

How does BobWork Vault keep team 2FA codes off a single phone?

BobWork Vault stores authenticator (TOTP) secrets with the login, so a teammate with access gets the 6-digit code in the browser instead of asking a colleague's phone. It is a free team password manager with a Chrome extension (also Edge, Brave and Arc) and a web vault that works in any modern browser.

• Add the secret once: scan the QR on the current page with the extension, or paste or upload a QR screenshot. A Google Authenticator export QR imports several accounts at once. QR images are decoded in the browser.
• Fill the code: after filling the password, the extension fills or copies the current code.
• Backup codes per login: store recovery codes with the login, mark them used, and get a warning when few are left. Members with Login only access never receive them.
• See who holds what: each login can record who holds its 2FA (SMS, email or app prompt, plus a teammate and a hint), and a 2FA map shows which logins depend on one person.
• Ask for the code: when a code still lives on someone's phone, a teammate can ask for it in the extension or web vault; the holder gets an email and a notification and sends the code back encrypted to that teammate only, expiring in 10 minutes.

Everything is encrypted in the browser before it is stored, and BobWork Vault has no mobile app, so it complements a personal authenticator app rather than replacing it on your phone.

Checklist: moving your authenticator app to a new phone

Use this checklist in order, and do not reset the old phone until every box is ticked.

1. List every account in the old authenticator app.
2. Save or regenerate backup codes for each one and store them off both phones.
3. Move shared business accounts into a team vault with their backup codes.
4. Install the authenticator app on the new phone and turn on automatic date and time.
5. Transfer accounts by export QR, sync or re-enrolment.
6. Sign in to each account with a code from the new phone.
7. Remove accounts from the old phone, then reset it.

If your team's shared 2FA still sits on one person's phone, create a free BobWork Vault account and add those secrets before the next phone change.

Try BobWork Vault — free for your whole team

BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.

Keep reading

• How to share 2FA codes with your team without waiting for one person's phone
• What Is a 2FA? Two-Factor Authentication Explained for Business Accounts
• Shared SMS 2FA: what to do when the code goes to one person's phone
• Employee offboarding checklist: what to revoke, rotate and hand over

More: free password manager · free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers