How do I move my authenticator app to a new phone?

The transfer that has to happen before the old phone is wiped, how to move codes with and without an export feature, and what to do if the old phone has already gone.

Difficulty: intermediate
Time: 45 min
Read: 3 min
Safety: caution

Short answer

Move the authenticator before you wipe the old phone. Most authenticator apps now offer a transfer or export function, usually producing a QR code you scan on the new phone. Then sign in to each account from the new device to confirm before the old one is erased.

This is the single most common way people lock themselves out of their own accounts. The phone migration moves apps, photos and messages faultlessly, and quietly leaves the authenticator behind.

Safety

Do not wipe, sell or return the old phone until you have signed in successfully to every account using the new one. Authenticator codes are not part of an ordinary phone backup on every app, and once the old phone is wiped, accounts without recovery codes may need a lengthy identity process to recover.

How two-factor sign-in works, and where it fails

Step by step

Do this before anything else on the new phone.Set up the new phone as far as being able to install apps, then move the authenticator. Everything else can wait; this is the item with a hard deadline.
Check whether your authenticator has an export or transfer function.Most major authenticator apps now do. It typically produces a QR code on the old phone that the new phone's app scans, moving all entries at once.
Check whether it syncs through an account instead.Some authenticators back up to a cloud account, so signing in on the new phone restores everything. If yours does, confirm the backup is actually switched on rather than assuming.
If there is no export, re-enrol account by account.For each account, sign in on a computer, go to security settings, turn two-factor off and immediately on again, and scan the new QR code with the new phone. Tedious, but reliable.
Start with email, then money, then everything else.Email is the reset route for everything, so it goes first. Then banking and payment accounts, then work, then the rest.
Print fresh recovery codes as you go.Re-enrolling usually offers a new set. Print them. This is the natural moment to fix the recovery arrangement for every account at once.
Test each account from the new phone.Actually sign out and back in on at least the critical ones. An entry that appears in the app but generates rejected codes is not obvious until you try.
Only then wipe the old phone.Sign out of the manufacturer account, factory reset, and remove it from your account's device list. Keep it in a drawer for a fortnight if you can.

Tips

If you have a tablet or a second device, enrolling it as a second authenticator for critical accounts removes this problem permanently.
Some accounts allow two authenticators at once. Where they do, add the new phone before removing the old one rather than switching.
Hardware security keys sidestep the whole issue: they move between phones because they are physical.

Common mistakes

Wiping the old phone as soon as the new one is set up — Phone migration tools do not always carry authenticator entries. This is the moment most lockouts are created, and it is entirely avoidable.
Assuming a phone backup includes the codes — Some authenticators deliberately exclude themselves from backups for security reasons. Check rather than assume.

If it doesn't work

Old phone already wiped and codes lost

Cause: The authenticator was not transferred — Fix: Use recovery codes if you have them. Otherwise start each service's account recovery process — it works, but requires identity evidence and time. Do the email account first.

Codes generated but rejected as wrong

Cause: The phone's clock is out of step; these codes are time-based — Fix: Set the date and time to update automatically on the new phone, and check the authenticator's own time correction setting if it has one.

Some accounts moved, others did not

Cause: Partial export, or entries added after the export — Fix: Compare the two lists side by side before wiping anything, and re-enrol the missing ones individually.

Old phone is broken and will not switch on

Cause: No opportunity to export — Fix: Use recovery codes. If the phone is only cracked rather than dead, a repair shop may get it running long enough to export.

Questions people ask

Can I have the same account on two authenticators?

Often yes — scanning the same setup QR code with two devices enrols both. Doing that at setup time for critical accounts is the simplest insurance there is.

Should I switch to SMS codes to avoid this?

No. SMS is the weakest second factor and vulnerable to SIM swap fraud. Fix the transfer problem instead, with recovery codes and a second enrolled device.