Importing and exporting accounts
Import
All importing happens on the device. Files are never uploaded anywhere.
| Source | How |
|---|---|
| Google Authenticator | Its Transfer accounts QR codes, scanned with the webcam or phone camera, or from images |
| Aegis | JSON export, plain or encrypted |
| 2FAS | .2fas export, plain or with a password |
| Bitwarden and Bitwarden Authenticator | JSON or CSV (plain) |
| 1Password | .1pux export |
| Ente Auth | Plain text export, or its encrypted export |
| FreeOTP and FreeOTP+ | Their exports |
| andOTP | JSON, plain or encrypted |
| Authenticator Pro (Stratum) | Backup file, plain or encrypted |
| KeePassXC, KeePassDX, KeePass | KDBX database (with its password), or CSV |
| Raivo OTP | JSON export |
| Apple Passwords | CSV export |
| Anything else | A list of otpauth:// links, single QR codes, or the setup key typed in |
Can't be imported (these apps don't let codes out; the move checklist helps set each account up again):
- Microsoft Authenticator;
- Authy;
- Duo Mobile;
- Yubico Authenticator.
Not supported: Proton Pass and Proton Authenticator, encrypted Bitwarden exports, and Raivo's password-protected ZIP.
Safeguards:
- every account is shown before it's saved;
- duplicates are flagged;
- sites are added from the known-services list;
- accounts with no site are flagged for binding later.
The move checklist
For accounts that can't be imported, a checklist lists the services to move and links to each one's 2FA settings (using the public 2fa.directory list). It tracks progress ("7 of 12 moved"), so the move can be spread over several sessions.
Export
- What can be exported: a Google Authenticator transfer QR code, one QR code per account, a file of
otpauth://links, or an encrypted Autothenticator backup. - Always available, in every edition. Nobody is locked in.
- Plain exports show the secret keys. The app asks for the passphrase again and warns before showing them, and the text file isn't encrypted.
- Personal fill-only accounts are included, since they're the person's own.
- Accounts under an organisation's rules, and shared team accounts, are never exported.