From the blog

How to back up your 2FA codes so you never lose them when you switch phones

Published June 20, 2026. A plain-language guide for anyone with an authenticator app.

You set up two-factor authentication years ago because a bank, or an email provider, or some website made you do it. You installed an authenticator app, scanned a few QR codes, and forgot about it. It just works. Every time you log in, you open the app, read off a 6-digit code, and you are in.

Then one day you get a new phone. Or you drop the old one in a lake. You set up the new phone, reinstall your apps, open the authenticator, and it is empty. Every code is gone, and every account that asks for one is suddenly out of reach.

This is for the ordinary person who has quietly worried about exactly that. You are not a security expert. You have maybe a dozen accounts protected with codes, you are not totally sure how the app works, and you have a vague sense that losing your phone would be a very bad day. Good news: it does not have to be. Backing up your codes takes about a minute, and this guide walks through every option, including what to do if you are reading this because it already happened.

Why a new phone wipes out your codes

Here is the part nobody explains. When you add an account to an authenticator, the app stores a small secret on your phone. The 6-digit codes are calculated from that secret and the current time, which is why they change every 30 seconds. The secret never leaves the phone unless you back it up somewhere on purpose.

That design is good for security. A secret that lives in exactly one place is hard to steal. But it has an obvious downside: if that one place is your old phone, and your old phone is at the bottom of a lake, the secret goes with it. The accounts themselves are fine. Your bank still exists. But the app that proves it is you is gone, and getting back in means going service by service through each one's recovery process, which can take days.

The 60-second version, if you do nothing else

If you only do one thing after reading this, do this: open your authenticator today, while your phone still works, and set up a recovery option. Every good authenticator gives you one. Doing it now, before anything goes wrong, turns a multi-day ordeal into a two-minute restore later.

The rest of this guide explains the three ways to make that happen, from the one you do by hand to the one that happens automatically.

Three ways to never lose your codes

Save a recovery key (free)

When you create your Fob account, Fob walks you through setting up a recovery key: a one-time code you write down and keep somewhere safe, like the drawer where you keep your passport. It is the key that gets you back in if you are ever locked out, after a new phone or a forgotten password. Without something like it, a forgotten password can mean starting over. With it, you can always get back in.

It is free, it takes about a minute during setup, and it is the single most important thing on this list. Fob asks you to do it up front for a reason.

Export your accounts to a file (free)

Fob also lets you export your accounts to a file at any time, with no subscription. You keep the file. Put it in your cloud drive, on a USB stick, or print it and file it with your important documents. On a new phone, you import that file and your accounts are back.

This is your insurance policy and your exit door at once. If you ever decide Fob is not for you, that same export moves your accounts to a different app. Your codes are yours. We cannot hold them hostage, and we would not want to.

Turn on encrypted cloud backup (Fob Premium)

If you would rather not think about any of this, Fob Premium adds encrypted cloud backup. Your vault is backed up automatically, in a form only your own devices can unlock. Get a new phone, install Fob, sign in, and your accounts are already there. Nothing to remember, nothing to file.

"Encrypted" here is not a marketing word. The backup is scrambled on your phone before it ever leaves it, so even Fob cannot read what is inside. This is the hands-off option, for people who want a backup that just happens.

I already switched phones and my codes are gone

If you are reading this after the fact, do not panic. You usually have more options than it feels like right now.

1. Check the old phone first. If it still turns on at all, you can still open the authenticator and export or transfer your accounts before you wipe it. A cracked screen is not the same as a dead phone.
2. Look for backup codes. When you turned on 2FA, many services handed you a short list of one-time backup codes and told you to save them. Check your email, your password manager, your downloads folder, and any printouts. One of those codes will get you into that account.
3. Use each service's recovery process. Banks, Google, Microsoft, and most major sites have a "lost my authenticator" path. It usually means proving who you are with ID or a secondary email, and it takes time, but it works.
4. Set up a recovery option on day one this time. Once you are back in, do the 60-second setup above on your new app before you move on. You do not want to do this twice.

What about Google Authenticator?

A lot of people reading this are on Google Authenticator, because it is the app most websites point you to. For years it had no backup at all, which is exactly why so many people have a lost-codes horror story. Google added a cloud sync feature in 2023, which helps, but it is tied to your Google account, and the backup is not the kind only you can unlock. Google can read it.

For some people that is fine. For others it is a reason to use an app where the backup is locked to them alone. If you want to move your accounts over, the step by step is in our Google Authenticator import guide, and it takes about a minute.

Set it up once, then forget about it

Losing access to your accounts is one of those problems that feels impossible until it happens to someone, and then it feels obvious. The fix costs you one minute today. Open your authenticator, set up a recovery key or turn on backup, and the new-phone day stops being something you dread.

That is the whole point of an authenticator. It should protect your accounts without becoming the thing that locks you out of them.