AltF Authenticator

Google Authenticator export decoder

Google Authenticator's Transfer accounts feature packs your accounts into otpauth-migration:// QR codes that only it understands. This tool decodes that QR in your browser and shows each account as a standard otpauth:// link and Base32 secret, so you can move them to another app. Nothing is uploaded.

  • Free, no sign-up
  • Secrets stay in your browser
  • RFC 6238 self-test built in
  • Works on mobile

How to export from Google Authenticator

  • On the phone with your accounts, open Google Authenticator.
  • Open the menu, choose Transfer accounts, then Export accounts. You may need to unlock the phone.
  • Select the accounts to export. Large exports are split over several QR codes.
  • Upload a screenshot or photo of each QR code to the Decode export tab, or scan it with your new app.

What is inside the export QR

The QR holds a link of the form otpauth-migration://offline?data=... The data part is base64 text that wraps a small protocol buffer. For each account it lists the raw secret bytes, name, issuer, algorithm, digit count and type (TOTP or HOTP, with the counter). The decoder reads these fields and rebuilds a normal otpauth:// link for each account.

Do it safely

  • The export holds every secret it contains in plain form. Do not send it by email or chat, or keep the screenshot afterwards.
  • Use a device you trust and close the tab when you finish.
  • Check that every account shows a working code in the new app before you delete anything from the old phone.
  • Delete any screenshots of the export QR, including from cloud photo backups.

After decoding

Each decoded account appears with its issuer, account name and an otpauth:// link. You can add it to the Live codes tab to compare codes with your phone, copy the link into another authenticator app or password manager that accepts otpauth:// links, or show it as a QR code to scan. Once every account works in its new home, remove it from Google Authenticator if you no longer need it there.

Google Authenticator export decoder: questions and answers

How do I move Google Authenticator to a new phone?

Use Transfer accounts, then Export accounts on the old phone and scan the QR codes with Google Authenticator on the new phone. Use this decoder only if you want the accounts in a different app.

Is the export sent to AltFTool?

No. The QR image and its contents are decoded in your browser. Nothing is uploaded.

Why does it show some accounts with odd settings?

The export records each account's algorithm and digits. Most are SHA-1 and 6 digits; anything else is shown as stored.

Can it read exports from other apps?

Only Google Authenticator's otpauth-migration format and plain otpauth:// links. Encrypted backups from other apps must be opened in those apps.

Authenticator tools and 2FA guides

All authenticator toolsThe full studio: live codes, setup, verify, HOTP, export decoder, backup codes, clock check and self-test.TOTP code generatorGenerate TOTP 2FA codes from a Base32 secret, otpauth:// link or QR image. SHA-1, SHA-256 or SHA-512, 6 or 8 digits, calculated in your browser.otpauth QR code generatorBuild an otpauth:// URI with issuer, account, algorithm, digits and period, and draw the 2FA setup QR code in your browser. Free, nothing uploaded.TOTP secret key generatorGenerate a random 160-bit Base32 TOTP secret with your browser's secure random number generator, plus the otpauth link and QR code. Nothing is sent.TOTP code verifierCheck whether a 2FA code matches a secret within a window of time steps, and see which step matched and the clock drift that implies. Runs in your browser.HOTP generatorGenerate HOTP counter-based one-time passwords per RFC 4226 from a Base32 secret and any counter value. Includes the RFC test values. Runs in your browser.2FA backup codesGenerate random recovery codes, download or print them, and learn where to store your real 2FA backup codes so a lost phone does not lock you out.2FA code not workingWhy your authenticator code is rejected and how to fix it: check your device clock, the secret, the account and non-default settings. Free clock check.RFC 6238 test vectorsThe 18 RFC 6238 Appendix B TOTP test vectors for SHA-1, SHA-256 and SHA-512, with seeds, times and expected 8-digit codes, run live in your browser.

Guides

What is TOTP?What TOTP is, how authenticator apps make 6-digit codes from a secret and the time, how it compares with SMS and passkeys, and what it protects against.Lost phone 2FA recoveryLost or reset the phone with your authenticator app? Steps to get back into accounts with backup codes or recovery, then set 2FA up safely again.SMS vs authenticator appSMS codes, authenticator apps, passkeys and security keys compared: what each protects against, the risks of SIM swap and phishing, and what to choose.

AltFTool never receives your secrets or codes. The only network request any tab makes is the clock check, which asks AltFTool's server for the time and carries nothing else.