Import Google Authenticator codes without exposing the export QR

Prepare a working source and an unlocked destination

Keep your old authenticator available until the replacement works. On the device with Google Authenticator, locate its transfer or export accounts option; exact menu labels may differ by app version. Choose the entries you actually need and allow the app to display the export QR. In 2FASync, sign into the intended member account and unlock its encrypted Vault before opening the import flow. Google sign-in permits access to the cloud identity; the separate Vault passphrase or recovery material controls local decryption.

This process is an import from a user-generated QR, not an automatic connection to Google's code synchronization feature. Google Authenticator may offer its own Google Account-based sync within its own app; 2FASync does not read that Google cloud store through OAuth. Do not remove or reset the old authenticator until the new copies have been checked against the original websites.

Scan or select the export locally

Open the import interface in the unlocked Vault. If the browser grants camera permission, point it at the export QR; alternatively, use a supported local image file that you control. Keep the image on a device you trust. Do not upload it to a public QR decoder, a generic support form, a cloud screenshot gallery, or a chatbot, because the encoded payload may let another person generate future codes for your accounts.

Some Google Authenticator exports are split into multiple numbered QR pages. Each page is a fragment of one batch. Collect every fragment from the same export before continuing to the final preview. Mixing separate exports or proceeding with a partial batch can leave important accounts missing. If the import UI reports a missing page or conflicting batch, return to the old device and complete the source export rather than editing the encoded payload yourself.

• Keep the source authenticator intact and accessible.
• Choose the exact accounts to export in Google Authenticator.
• Scan each QR page from one batch, or select a supported image kept locally.
• Review the final preview before committing any supported entries.

Read the preview: new, duplicate, invalid, or unsupported

The local decoder interprets known fields and displays issuer, account, and status. A code entry that matches an existing credential can be marked duplicate, while a matching label with a different key deserves explicit attention. Do not assume that two similarly named accounts share the same seed. The user selects which supported TOTP records to import, and encryption happens before normal member ciphertext synchronization.

2FASync rejects counter-based HOTP entries rather than converting them into time-based codes. Unknown algorithm or digit configurations, invalid secrets, and unsupported versions may also be rejected. The Google migration profile does not include a configurable period, so recognized TOTP records use the profile's 30-second interval. An unsupported row is an instruction to investigate its original service, not a reason to silently discard a necessary login factor.

Verify the moved authenticator before cleaning up

After import, compare each new Vault entry with the old authenticator and the original website's account security screen. Check that the account label is correct, the code changes in the expected window, and the website accepts the new code. Imported TOTP entries may produce the same value as Google Authenticator because they contain the same underlying secret; this alone does not prove your Vault backup and recovery path is ready.

Save recovery material separately, complete an encrypted backup when the member controls are available, and only then decide whether to remove copies from the old device. If an account was excluded or marked unsupported, retain its existing authenticator until that account is moved or safely re-enrolled through the original service. Re-enrollment is usually how to revoke a seed that may have been disclosed during a transfer.

When transfer goes wrong

A camera permission error can often be resolved by checking browser site permissions and retrying from an explicit user action. A blurred image or crop may yield no QR at all. If the batch reports incomplete fragments, generate the export again and scan all of its pages from the same session. If the preview says HOTP or unsupported algorithm, inspect the account's original configuration; the tool cannot safely guess missing profile state.

Never solve an import error by emailing the export screenshot to someone who claims they can repair it. Use the troubleshooting instructions to record an error category, file type, and rough step number without reporting the QR payload, setup key, or current code. A credential you sent outside the intended device boundary should be treated as potentially exposed and rotated at the originating website.

Does Google Authenticator export delete my old codes?

Do not treat export as deletion or revocation. Verify the destination and manage the original app and website enrollment separately.

Why does import ask for more than one QR?

Google Authenticator can split a selected export into several fragments. 2FASync requires a complete consistent batch before presenting its final entries.

Can HOTP entries be converted to TOTP during import?

No. HOTP uses a moving counter, whereas TOTP uses time. 2FASync marks HOTP entries unsupported and does not silently convert them.