Migration guide

How to Migrate from Aegis to Fob in 2026

Published April 25, 2026. Works whether or not you use Fob.

Aegis is, if you are an Android-only user who values FOSS, almost certainly the right authenticator. It is fast, locally encrypted with sensible defaults (Argon2id KDF, AES-256-GCM), GPL-3.0, and maintained in the open. The export format is a real export. The community is real. If that profile fits you, you do not need this guide. The honest version of this page starts there.

This guide is for the cases where Aegis stops fitting. The most common ones: you want an iPhone option for your codes, you have a partner or family who needs shared access to a few accounts, or you want encrypted cloud backup without setting up rclone and a Nextcloud instance yourself. None of those are on Aegis's roadmap. That is not a flaw in Aegis; it is the project's design philosophy.

The good news is that the migration is short. Aegis exports an encrypted JSON file by design. Fob reads it. Five minutes, one file, done.

Why move from Aegis (or why not)

Aegis is genuinely good. The places where it is not the right answer are specific:

• No iOS. Aegis is Android-only and will stay that way. If you carry an iPhone, or want a partner with one to share an account, Aegis cannot solve it.
• No managed cloud sync. Aegis writes encrypted local backups to a folder you can then sync with Google Drive, Nextcloud, Syncthing, or anything else you trust. Fine if you already run that infrastructure; more setup than most users want for a 2FA app if you do not.
• No family or shared accounts. Sharing in Aegis means handing over the device or scanning the same QR into a second phone, which doubles the secret material in circulation. There is no first-class shared-account model.
• Single-group filter. Aegis lets you assign each entry to one group and filter the list by group. At 60+ accounts that breaks down: a Coinbase account is crypto, exchange, and high-value simultaneously, and Aegis makes you pick one.

If those four are non-issues for you, Aegis is the better app. Stay there. If even one of them bites, the rest of this guide is for you.

What you keep, what you do not

Aegis exports the entire vault. Every account, with every property: secret, issuer, name, algorithm (SHA-1, SHA-256, SHA-512), digit count, period, OTP type (TOTP or HOTP), notes. Fob preserves all of those.

Two things do not transfer cleanly:

• Custom icons. Aegis lets you assign custom PNGs per entry; Fob ships its own icon set keyed off the issuer field. Accounts work identically, they just look like the Fob default.
• Group assignment. Aegis groups become Fob tags during import. Each entry that had a group gets one tag with the same name. You add more tags after, which is the point.

Everything else (the secret material that actually generates the codes) transfers exactly.

The Aegis export format

Aegis produces a .json file. Two flavors:

• Encrypted (the default and the right choice): the db field is a base64 blob, encrypted with AES-256-GCM. The key is derived from your Aegis password using Argon2id with the parameters Aegis stores in the file header. Fob reads the same parameters and runs Argon2id with your password to decrypt. The file is meaningless to anyone without the password.
• Plain text: the db field is the raw JSON. Anyone who can read the file can read your secrets. Use this only if you are immediately importing and immediately shredding; never store a plain-text Aegis export anywhere.

Use the encrypted export. Fob handles both, but the plain-text export is a shotgun pointed at your own foot. If you have to move a file across machines, encrypted only.

There is no protobuf, no QR batch, no proprietary container. The file format is documented in the Aegis repository, which is part of why Aegis is trusted in the first place.

How to migrate in about five minutes

On Android, with Aegis open:

1. Open Aegis, tap the menu (three dots, top right), and choose Settings > Import & Export > Export.
2. Pick Encrypted (recommended). Aegis prompts for the same password you use to unlock the app. That is the password the file is encrypted with.
3. Save the resulting .json file somewhere you can reach from the destination device. Local storage, an SD card, a one-time-use cloud drop. Treat it like a password file: do not email it, do not paste it into chat, delete it when you are done.
4. On your destination phone, open Fob, tap Add account, and choose Import from Aegis.
5. Pick the .json file, enter your Aegis password. Fob runs Argon2id locally, decrypts the vault in memory, and shows you the list it found.
6. Review the list. Group assignments come across as tags; add more tags now or later.
7. Confirm the import.

That is it. The decryption happens entirely on-device. The file never leaves your phone. The plaintext vault is never written anywhere except the Fob database, which is itself encrypted.

After the import, delete the export file, both the Android source and any cloud copy you used to move it across. It is a static snapshot of every secret you have.

What happens to your Aegis data

Nothing, unless you remove it.

Exporting is a read operation. Aegis still has every account on the original device until you uninstall or wipe the vault. The secrets are not invalidated by the export. This matches how Google Authenticator's export works, and for the same good reason: an export should not break your fallback.

The recommended path for a few days after migration:

• Use Fob as the primary app.
• Keep Aegis installed as a fallback. If a service rejects a Fob code (rare, but it happens with services that have clock drift), Aegis still has the secret.
• Once you have logged into every account at least once using Fob codes, uninstall Aegis or wipe its vault. Until then, leave both apps in place.

If you used Aegis's automatic local backup, the encrypted file is still in whatever folder you pointed it at. Delete it, or keep it as a deliberate cold backup but treat it like a password file.

After migration, what Fob does differently

The migration is the point of this page; Fob is one option among several. Here is what changes if you end up on Fob rather than 2FAS or the Bitwarden authenticator.

• Tags, not groups. A Coinbase account can be crypto, exchange, and high-value at the same time. Filter by any combination, save the filter, switch tags in two taps. No other authenticator has this. This is the reason most Aegis users who migrate end up here.
• iOS coming. Android first, iOS after. The same vault, the same accounts, the same tags on both.
• Zero-knowledge sync. Your vault is encrypted on-device with AES-256-GCM. The key is derived from your password with Argon2id (the same primitives Aegis uses, for the same reasons) and never leaves your devices. Fob's servers hold a blob they cannot read. Architecture details at /security.
• Family sharing (post-MVP). Some accounts (the streaming login, the household bank login) belong to more than one person. Fob will support sharing a specific account with another Fob account, encrypted to both vaults. Aegis does not do this and will not.
• Export any time. If Fob ever stops being the right choice for you, your vault exports in an open format behind a reauth prompt. You can put it back into Aegis the same day. Fob is structurally unable to hold your codes hostage. This is the same property that made Aegis trustworthy to you in the first place.

The thing Fob does not do that Aegis does: source code you can read. Fob is closed source. The substitutes for source access are the export-always guarantee above, the architecture description at /security, and a third-party security audit committed post-launch (the report posts at /security when complete). Whether that is a fair trade depends on what made you pick Aegis in the first place. Some Aegis users will close the tab here, and that is the right call for them.

If you also have accounts in Authy, see /import/authy. For Google Authenticator, /import/google-authenticator. For Microsoft Authenticator, /import/microsoft-authenticator. For Bitwarden, /import/bitwarden.

Fob is on Google Play, Android first. iOS follows; get notified from the homepage when it lands.

FAQ

Can I import the encrypted Aegis export, or do I have to decrypt it first?

Encrypted is the right path. Fob accepts the encrypted Aegis JSON directly: pick the file, enter your Aegis password, and Fob runs Argon2id locally to decrypt. The plaintext never touches storage and never leaves your phone. Plain-text Aegis exports also work, but there is no reason to use them; a plain-text dump in the wrong place is a 2FA breach you have to migrate through a second time.

Is Fob open source like Aegis?

No. Fob is closed source. The trust model substitutes three things for source access: every Fob vault exports in an open format any time you ask, the encryption architecture is published at fob.codes/security with the actual primitives and parameters, and a third-party security audit is committed post-launch (the report posts at fob.codes/security when complete, and the plan is to repeat it annually). If you picked Aegis primarily because the source is auditable, those substitutes may not be enough for you, and Aegis is the right call. If you picked Aegis because you wanted a real export and zero-knowledge encryption you can reason about, Fob hits both of those without source access.

When will Fob support iOS?

Android first, iOS second. iOS is on the public roadmap, not on the calendar with a date. The same vault and tag set will work on both, with the same end-to-end encrypted cloud backup underneath. If iOS is the only reason you are leaving Aegis, the iOS notify list on the homepage is the right place to wait; the iOS build will reach those subscribers first.

Do my Aegis groups become Fob tags, or do I lose the organization?

Each account that had a group in Aegis comes into Fob with one tag of the same name. Aegis allows one group per account; Fob allows multiple tags. Most users add a second and third tag to their highest-stakes accounts (high-value, crypto, daily) in the first session and find that the organization problem they had at 60 accounts in Aegis was a single-axis problem all along, not a count problem.

What about my custom icons?

Aegis lets you set custom PNGs per entry. Fob does not import those. Fob ships its own icon set keyed off the issuer field, so accounts will look like the Fob default for that issuer rather than your customized version. The accounts work identically; only the visual changes. If a custom icon set was load-bearing for you, that is a fair reason to stay on Aegis.