Migration guide

How to Migrate from 2FAS to Fob in 2026

Published April 25, 2026. Works whether or not you use Fob.

2FAS is one of the few FOSS authenticators that ships on Android, iOS, and as a browser extension, with no account required and a real encrypted export. If you came to it because you wanted free, auditable code without a vendor relationship, it has earned that trust. The honest version of this page starts there: a lot of 2FAS users do not need to leave, and this guide is not trying to talk you out of it.

This guide is for the cases where 2FAS stops fitting. The ones we hear most often: you have crossed past 50 or 60 accounts and a single group per entry no longer holds the structure you need, you want to share two or three accounts with a partner or family without scanning the same QR twice, or you want one single-vendor stack with a committed audit instead of a FOSS authenticator plus separate cloud-backup tooling plus separate browser-extension trust.

The migration itself is short. 2FAS exports a .2fas JSON file by design, encrypted if you set a backup password. Fob reads it. Five minutes, one file, done.

Why move from 2FAS (or why not)

2FAS does several things well that this guide is not going to pretend otherwise about. The browser extension with push-to-approve sign-ins is a real convenience win. The iOS app exists and is maintained. The export is honest. The license is MPL-2.0. If those are the things keeping you on 2FAS, stay on 2FAS; nothing below changes that.

The places where it is not the right answer are specific:

• Single group per account. 2FAS lets you assign each entry to one group and filter the list by group. At 60+ accounts that breaks down: a Coinbase account is crypto, exchange, and high-value simultaneously, and 2FAS makes you pick one. Fob is the only authenticator that lets one account carry multiple tags and filter by any combination.
• No family or shared accounts. Sharing in 2FAS means handing over the device, exporting a single-account QR and rescanning it on a second phone, or just splitting the secret material into two installations. There is no first-class shared-account model where revoking access on one device does not require touching the other.
• Cloud sync is your problem. 2FAS supports iCloud (iOS) and Google Drive (Android) backup, but those are platform-specific and do not bridge across iOS and Android in one vault. If you have an iPhone and your partner has a Pixel, there is no shared 2FAS vault between you. Cross-platform backup means manual export files.
• Browser extension trust is separate. The 2FAS browser extension is genuinely useful, and it is also a separate piece of software with its own attack surface, paired to your phone over a relay. If your trust posture is "fewest moving parts, one vendor, audits I can read," that is a different shape than 2FAS offers.

If those four are non-issues for you, 2FAS is the better app. Stay there. If even one of them bites, the rest of this guide is for you.

What you keep, what you do not

2FAS exports the entire vault. Every account, with every property: secret, issuer, name, algorithm (SHA-1, SHA-256, SHA-512), digit count, period, OTP type (TOTP, HOTP, Steam), service icon hint. Fob preserves all of those.

Two things do not transfer cleanly:

• Browser extension pairings. The pairing between your 2FAS phone app and the 2FAS browser extension is a separate trust relationship that lives in the extension itself. It is not in the export file. Migrating your codes to Fob does not migrate the extension; you would need to disable the extension or keep the 2FAS app installed alongside Fob if you want the push-to-approve sign-in flow.
• Group assignment. 2FAS groups become Fob tags during import. Each entry that had a group gets one tag with the same name. You add more tags after, which is the point.

Everything else (the secret material that actually generates the codes) transfers exactly.

The 2FAS export format

2FAS produces a .2fas file. The contents are JSON. Two flavors:

• Encrypted (the right choice if the file is going to be on disk for more than a few minutes): the servicesEncrypted field is a base64 ciphertext, encrypted with AES-256-GCM. The key is derived from the backup password you set, using PBKDF2. The services array is omitted. The file is meaningless to anyone without the password.
• Plain text: the services array is the raw account list. Anyone who can read the file can read your secrets. Use this only if you are immediately importing and immediately shredding; never store an unencrypted .2fas export anywhere.

Use the encrypted export. Fob handles both, but the plain-text version is a shotgun pointed at your own foot. If the file has to cross devices over anything other than a direct cable, encrypted only.

There is no protobuf, no QR batch, no proprietary container. The file format is documented in the 2FAS repository, which is part of why 2FAS is trusted in the first place.

How to migrate in about five minutes

With 2FAS open on the device that has your accounts:

1. Open 2FAS, tap Settings, then Backup, then Export.
2. Set a backup password when prompted. Pick something you will remember for the next ten minutes; you will type it once on the destination device and then delete the file. Treat it like a passphrase, not a PIN.
3. Save the resulting .2fas file somewhere you can reach from the destination device. Local storage, an SD card, a one-time-use cloud drop. Treat it like a password file: do not email it, do not paste it into chat, delete it when you are done.
4. On your destination phone, open Fob, tap Add account, and choose Import from 2FAS.
5. Pick the .2fas file, enter your backup password. Fob runs PBKDF2 locally, decrypts the vault in memory, and shows you the list it found.
6. Review the list. Group assignments come across as tags; add more tags now or later.
7. Confirm the import.

That is it. The decryption happens entirely on-device. The file never leaves your phone. The plaintext vault is never written anywhere except the Fob database, which is itself encrypted.

After the import, delete the export file, both the source on the original device and any cloud copy you used to move it across. It is a static snapshot of every secret you have.

What happens to your 2FAS data

Nothing, unless you remove it.

Exporting is a read operation. 2FAS still has every account on the original device until you uninstall or wipe the vault. The secrets are not invalidated by the export. This matches how Aegis and Google Authenticator handle it, and for the same good reason: an export should not break your fallback.

The recommended path for a few days after migration:

• Use Fob as the primary app.
• Keep 2FAS installed as a fallback. If a service rejects a Fob code (rare, but it happens with services that have clock drift), 2FAS still has the secret.
• If you used the 2FAS browser extension, leave it paired until you have logged into every account at least once with Fob codes. After that, unpair the extension from inside the 2FAS app, then uninstall.
• Once you have logged into every account at least once using Fob codes, uninstall 2FAS or wipe its vault. Until then, leave both apps in place.

If you used 2FAS's iCloud or Google Drive backup, the encrypted file is still in your cloud account. Delete it from the platform-specific backup location, or keep it as a deliberate cold backup but treat it like a password file.

After migration, what Fob does differently

The migration is the point of this page; Fob is one option among several. Here is what changes if you end up on Fob rather than Aegis or the Bitwarden authenticator.

• Tags, not groups. A Coinbase account can be crypto, exchange, and high-value at the same time. Filter by any combination, save the filter, switch tags in two taps. No other authenticator has this. This is the reason most 2FAS users who migrate end up here.
• One vault across platforms. Android first, iOS after. The same vault, the same accounts, the same tags on both, with the same encrypted sync underneath. No platform-specific backup file, no separate iCloud and Google Drive blobs to keep in sync by hand.
• Zero-knowledge sync. Your vault is encrypted on-device with AES-256-GCM. The key is derived from your password with Argon2id and never leaves your devices. Fob's servers hold a blob they cannot read. Architecture details at /security.
• Family sharing (post-MVP). Some accounts (the streaming login, the household bank login) belong to more than one person. Fob will support sharing a specific account with another Fob account, encrypted to both vaults, revocable from either side. 2FAS does not do this.
• Export any time. If Fob ever stops being the right choice for you, your vault exports in an open format behind a reauth prompt. You can put it back into 2FAS the same day. Fob is structurally unable to hold your codes hostage. This is the same property that made 2FAS trustworthy to you in the first place.

The thing Fob does not do that 2FAS does: source code you can read, and a paired browser extension. Fob is closed source. The substitutes for source access are the export-always guarantee above, the architecture description at /security, and a third-party security audit committed post-launch (the report posts at /security when complete). There is no Fob browser extension on the roadmap; if push-to-approve sign-ins from a desktop browser are the load-bearing 2FAS feature for you, that is a fair reason to stay on 2FAS.

If you also have accounts in Authy, see /import/authy. For Google Authenticator, /import/google-authenticator. For Microsoft Authenticator, /import/microsoft-authenticator. For Aegis, /import/aegis. For Bitwarden, /import/bitwarden.

Fob is on Google Play, Android first. iOS follows; get notified from the homepage when it lands.

FAQ

Can I import the encrypted .2fas backup, or do I have to disable the password first?

Encrypted is the right path. Fob accepts the encrypted .2fas file directly: pick the file, enter your backup password, and Fob runs PBKDF2 locally to decrypt. The plaintext never touches storage and never leaves your phone. Plain-text 2FAS exports also work, but there is no reason to use them; an unencrypted dump in the wrong place is a 2FA breach you have to migrate through a second time.

Is Fob open source like 2FAS?

No. Fob is closed source. The trust model substitutes three things for source access: every Fob vault exports in an open format any time you ask, the encryption architecture is published at fob.codes/security with the actual primitives and parameters, and a third-party security audit is committed post-launch (the report posts at fob.codes/security when complete, and the plan is to repeat it annually). If you picked 2FAS primarily because the source is auditable, those substitutes may not be enough for you, and 2FAS is the right call. If you picked 2FAS because you wanted a real export and zero-knowledge encryption you can reason about, Fob hits both of those without source access.

Does Fob have a browser extension like 2FAS?

No, and there are no plans for one. Fob is a phone-first authenticator: the codes live on your phone, you type them into the desktop sign-in form, the same as Google Authenticator or Aegis. The 2FAS browser extension's push-to-approve flow is genuinely convenient, and if it is the feature keeping you on 2FAS, that is a defensible call. The trade-off Fob is making is fewer moving parts, fewer paired surfaces, and one app to audit instead of an app plus an extension plus a relay between them.

Do my 2FAS groups become Fob tags, or do I lose the organization?

Each account that had a group in 2FAS comes into Fob with one tag of the same name. 2FAS allows one group per account; Fob allows multiple tags per account. Most users add a second and third tag to their highest-stakes accounts (high-value, crypto, daily) in the first session and find that the organization problem they had at 60 accounts in 2FAS was a single-axis problem all along, not a count problem.

What if I am on iOS today with 2FAS?

Fob is Android-first. iOS is on the roadmap, not on the calendar with a date. If iOS is the only thing keeping you on 2FAS, the iOS notify list on the homepage is the right place to wait; the iOS build will reach those subscribers first. If you are migrating an iOS 2FAS vault now to use on an Android device today, the export-and-import flow above works across platforms; the .2fas file format is the same on both.