Move to a new Android phone without losing authenticator access

Keep the old phone until the new one proves itself

The dangerous moment in a phone upgrade is accepting a trade-in or factory reset while your accounts still depend on the old handset. Move the authenticator, then prove that the replacement can get you into each account. A familiar app icon on the new home screen is insufficient evidence.

This guide covers Google Authenticator on Android, moving to another Android phone. It assumes you can still unlock the old phone. Microsoft Authenticator, employer approval prompts and passkeys need their own migration arrangements; do not count them as transferred by this procedure.

Set both phones beside you, charge them and keep the old phone locked when unattended. Preserve an existing signed-in browser session on a computer while working. That session gives you somewhere to inspect account settings, although sensitive changes may still require verification.

Make a way back before choosing a transfer route

List the service and username for every authenticator entry. Include separate personal and work logins, even when they share a service name. Record labels and completion marks, never the changing codes or setup secrets. This becomes your migration checklist.

Check how you would enter the Google Account used for Authenticator sync if neither phone were available. Depending on what you registered, Google's recovery guidance lists another signed-in phone, a security key, a passkey on another device or saved backup codes. A fallback that lives only on the phone you are replacing leaves a circular dependency.

For a personal Google Account, create or locate backup codes in a computer browser: Google Account > Security & sign-in > 2-Step Verification > Backup codes > Continue. Choose Get backup codes if needed, then Download Codes or Print codes. Store them somewhere protected that you can reach without either handset. Advanced Protection accounts cannot download these codes.

Google issues ten backup codes; each works once, and generating a replacement set invalidates the previous set. Refresh deliberately, replacing obsolete copies. Other services have their own recovery arrangements: check their security pages while access still works rather than assuming Google's codes unlock them.

Use the route that matches where your codes live

Install Google Authenticator from its Google LLC Play listing on the replacement. Update the old installation before manual transfer. Keep the two phones distinguishable throughout: put a small note beside each if their cases look alike.

If you already save codes to a Google Account

Open Authenticator on the old phone and inspect the profile picture or initials to identify the account. On the new phone, sign in inside Authenticator with that same Google Account. Google's app listing documents cross-device synchronization. Expect your saved entries to appear; compare their service names and usernames with your checklist.

Having several Google Accounts on Android can make the wrong selection easy. Read the full address, rather than recognizing only the avatar. An empty list is a reason to pause and inspect the chosen account, not permission to recreate everything or erase the old device.

If the codes are stored only on the old phone

Use the manual route in Google's Android transfer instructions. On a fresh installation, Use without an account is available if you want device-only storage. Google's illustrated-by-icons help text also describes onboarding through Get Started and account sign-in; choose your intended storage mode consciously.

1. On the old phone, open Authenticator and choose Menu > Transfer codes > Export codes. Unlock when asked.
2. Select the entries to move and tap Next. The old phone displays one or more transfer QR codes.
3. On the new phone, choose Menu > Transfer codes > Import codes, then Scan QR code. Scan every code shown by the old phone. Expect a transfer confirmation.

Keep transfer QR codes private. Scan directly between your phones, away from other cameras; do not email a photograph to yourself or upload it to a QR decoder. The transfer material deserves the same protection as an account credential. Close the export screen after importing.

Prove each login with the old phone out of reach

Set the old handset aside without erasing it. Start with the account that protects your email or password manager, then work through your checklist. For each service, open a private browser window on your computer and visit its known address yourself. Keep the original signed-in window available.

1. Start a fresh sign-in with the intended username and password. At verification, choose the authenticator-code method if the service offers several routes.
2. Read the code from the matching entry on the new phone and submit it. Mark the entry complete only after reaching the correct account.
3. Close that private session when finished. Continue until every entry has a recorded result; investigate any entry whose purpose you cannot identify.

An automatic passkey sign-in, an already-open account page or approval on the old phone does not exercise the authenticator entry. If a service will not offer a code challenge, mark that check unresolved and retain the old device while consulting that service's instructions.

For a hypothetical checklist of twelve entries, seeing twelve on the new phone is an inventory check. Eleven successful code sign-ins and one failure still mean one unresolved account. Neither the matching count nor success on your most-used account establishes that the twelfth credential works.

Stop at the failed check, not at the reset screen

For rejected codes, verify the service and username, try a fresh code before expiry, and check the phone's system time. Current Authenticator uses the operating system clock; do not hunt for the removed in-app time-correction setting. Android manufacturers arrange date-and-time settings differently, so search Settings for date and time and check automatic time.

If scanning fails, check camera access for Authenticator; Google identifies it as required for QR setup. Use Authenticator's import scanner, keep the entire QR square in view and reduce glare. If entries remain missing, preserve the old installation and compare which entries you selected before repeating a targeted export.

If the old phone becomes unavailable, manual export is no longer your route. Previously synced entries may still be reachable after account sign-in. For Google, select Try another way and, when offered, Enter one of your 8-digit backup codes; use an unused saved code. Without a usable fallback, follow Google's account recovery process. Each other service requires its own recovery or administrator assistance; reinstalling Authenticator cannot recreate an unavailable device-only credential.

Release the old phone only after the checklist closes

Do not delete synced entries from the old app as a cleanup step: deletion propagates to the other synced devices. Keep the verified new entries intact. Also avoid changing storage modes experimentally during migration.

Retire the old handset only when every required account has a successful new-phone check or a verified alternative, recovery material is reachable, and any separate work-authentication migration is complete. Then follow your handset's account-removal and factory-reset procedure, with its other data backed up. The authenticator checklist clears one dependency; it does not certify your photos, messages or banking apps.

If any check remains unresolved, keep the old phone secured and postpone the handoff. Retaining access is the reversible choice. Erasing the only working copy can turn a manageable transfer problem into an account-recovery case.