Migration guide

How to Migrate Personal Accounts from Duo Mobile to Fob in 2026

Published April 26, 2026. Works whether or not you use Fob.

Duo Mobile is the app most people did not choose. They installed it because IT pushed an SSO rollout at work, the onboarding email said "install Duo," and that was that. Then, because the app was already on the phone, personal accounts started to drift in: a bank that supports Duo as a TOTP option, a service that prompted them at signup, a habit of "I have an authenticator open already, let me just add this one here." Now there are eight or twelve or twenty personal accounts mixed into the same app the employer pushed, and the consumer experience has never been the strength of that app.

This guide is about moving the personal half. The work half stays exactly where it is. We will be explicit about why.

What this guide changes, and what it does not

Duo Mobile does two largely unrelated jobs:

• Duo Push for company SSO. The orange checkmark notification, the one your employer's identity provider sends when you sign into Okta, Microsoft Entra, or a corporate VPN. This is what Duo is best at and what most companies pay for. It is not TOTP, it is not portable to any other authenticator, and you cannot move it to Fob, Authy, Aegis, or anything else. If your employer requires Duo Push, you keep Duo installed.
• Personal TOTP accounts. The 6-digit codes you added yourself for your bank, your email, your crypto exchange, your social accounts. These are standard RFC 6238 TOTP, the same protocol every other authenticator implements. They are portable. They are what this guide is about.

If the only thing in your Duo Mobile app is your work account, this guide is not for you and you do not need to do anything. Keep using Duo. Read no further.

If you have personal TOTP accounts in Duo Mobile, the rest of this guide moves those off without touching the work surface.

Why move personal accounts out of Duo

Duo Mobile is excellent at the job Cisco built it for: company MFA push, with a security model designed around employer policy. The consumer flow has had less attention, and it shows in the places that matter to a personal user:

• No tags or folders for personal accounts. Duo Mobile sorts work accounts into the SSO list and personal TOTP into the "Third-Party Accounts" section. Inside that section there is no organizing principle past name. At twenty accounts that becomes hard to scan; at forty it is unworkable.
• No real export. Duo Mobile cannot produce a file or QR code that another app can import. The only "migration" path Duo supports is Duo Restore, which we will cover in the next section, and Duo Restore moves your TOTP accounts to another Duo install, not to a competitor.
• Backup is tied to a Duo account. If you skip Duo Restore at install and your phone breaks, the personal TOTP accounts are gone. Recovery is on you, per service, the long way.
• The app surfaces work features you do not need. Group push, admin policy hooks, identity provider integration screens. None of it is wrong, but it is bandwidth on a screen you only opened to copy a code into your bank.
• It is a Cisco app. Some users are uncomfortable with their personal 2FA living inside an app shipped by their employer's vendor of record. That is a defensible preference.

If none of those bite, the Duo Mobile personal flow is fine. If two or three do, the rest of this guide is for you.

Duo Restore is not export

This section exists because the question "does Duo have an export" produces a confusing answer if you ask it the wrong way. Duo has Duo Restore. Duo Restore is not an export.

• Duo Restore backs up your Duo Mobile data to Google Drive (Android) or iCloud Keychain (iOS), keyed to your Duo account. If your phone is lost or replaced, you reinstall Duo Mobile on the new phone, restore from the backup, and your personal TOTP accounts come back inside Duo Mobile.
• Export would be a file, a QR sequence, or some other portable format another authenticator could read. Duo does not ship this. There is no menu, no setting, no debug command. The accounts cannot leave Duo Mobile in any format a different app can read.

The practical consequence is the same as Authy: the only way to leave Duo Mobile with your personal accounts intact is to re-enroll them at the source. One service at a time. The wizard in your destination app, whatever you pick, can track progress as you go, but it cannot skip the manual re-enrollment.

How to migrate one personal account in about 60 seconds

On a desktop computer, with the service open in one window and your destination authenticator in your hand:

1. Log into the service using your current Duo Mobile TOTP code.
2. Navigate to Security or Account Settings > Two-factor authentication.
3. Disable 2FA. The service usually requires a current Duo Mobile code, and sometimes your password.
4. Immediately re-enable 2FA, choosing Authenticator app or TOTP, never Duo or Cisco Duo if those are listed separately.
5. Scan the new QR code with Fob. The new entry shows in your Fob vault and starts generating codes.
6. Test the new code before closing the tab. Type the 6-digit code from Fob into the service's confirmation field. If the service accepts it, the account is migrated. If not, scan again and retest.
7. Save the recovery codes the service prints on enrollment. Paste them into your password manager.

Repeat for every personal account. Keep Duo Mobile installed until the last personal account is confirmed working in Fob, in case a service rejects an enrollment and you need the Duo code as a fallback.

For the order to do them in (email first, then banking, then crypto, then everything else), the priority list in /import/authy applies the same way here.

What to do about your work account

Nothing. That is the whole answer.

• Leave Duo Mobile installed.
• Leave the work account inside it.
• Do not try to "move" the work account anywhere. The work account is a Duo Push token, not a TOTP secret, and it cannot live in another authenticator. Attempting to remove it will lock you out of work resources until IT re-enrolls you.

If your employer eventually moves off Duo (some companies switch to native passkeys, Microsoft Authenticator, or Okta Verify), that transition is owned by IT, not by you. Until then, two apps on your phone is the correct shape: Fob for personal, Duo Mobile for work. They do not interfere. The Cisco app's notifications stay scoped to company prompts; Fob's vault stays scoped to your personal accounts.

After migration, what Fob does differently

• Tags, not folders. A Coinbase entry can be crypto, exchange, and high-value at the same time. Filter by any combination. No other authenticator on the market has this.
• Personal-only, by design. Fob does TOTP for your accounts. It does not do company SSO push, identity provider integration, or admin policy. That focus is the reason the personal flow gets the attention.
• Mandatory recovery wizard at onboarding. No "I will set up sync later" path. The recovery story is the first thing you do, before you add a single account.
• Zero-knowledge sync. Your vault is encrypted on-device with AES-256-GCM. The key is derived from your Fob password with Argon2id and never leaves your devices. Fob's servers hold a blob they cannot read. Architecture details at /security.
• Export any time. If Fob ever stops being the right choice for you, your vault exports in an open format behind a reauth prompt. You can put it back into another authenticator the same day. Fob is structurally unable to hold your codes hostage.

If you also have accounts in Authy, see /import/authy. For Google Authenticator, /import/google-authenticator. For Microsoft Authenticator, /import/microsoft-authenticator. For Aegis, /import/aegis. For 2FAS, /import/2fas. For Bitwarden Authenticator, /import/bitwarden.

Fob is on Google Play, Android first. iOS follows; get notified from the homepage when it lands.

FAQ

Can I move my work Duo accounts to Fob?

No. The work account in Duo Mobile is a Duo Push token, not a TOTP secret. Push tokens are tied to Cisco's enrollment infrastructure and your employer's policy. They cannot be exported, copied, or migrated to a generic authenticator. If your employer mandates Duo for SSO, keep Duo Mobile installed and use Fob for personal accounts in parallel. The two apps do not interfere.

What is the difference between Duo Mobile and Duo Restore?

Duo Mobile is the app on your phone that holds your work push token and any personal TOTP accounts you added. Duo Restore is a backup feature inside Duo Mobile that copies your data to Google Drive (Android) or iCloud Keychain (iOS), so a new phone can restore the same Duo Mobile state. Duo Restore is not an export to another app. It only restores Duo data into Duo Mobile.

Is Fob OK with companies that require Duo Push?

Yes. Fob does not replace Duo for company SSO and does not try to. If your employer requires Duo Push, install Fob alongside Duo Mobile. Fob holds your personal TOTP accounts (your bank, crypto, email codes); Duo Mobile holds the work push token your identity provider needs. Two apps with non-overlapping jobs. This is the shape most users land on once they realize the personal and work surfaces are different problems.

Why does Duo make leaving so manual?

Duo's product is built for employers, not consumers. The employer expectation is that an IT team controls the enrollment lifecycle and a leaving employee re-enrolls on a new device through a managed flow. There has been no commercial pressure for Cisco to build a consumer-grade export, because the consumer surface inside Duo Mobile is incidental to the product's main job. The result is the same as Authy: leaving means re-enrolling at the source, one account at a time.

Is Fob a managed company SSO platform like Duo?

No. Fob is a consumer authenticator. It generates TOTP codes for your personal accounts, syncs them across your own devices through a zero-knowledge encrypted backup, and lets you organize them with tags. It does not provide push authentication for an employer's identity provider, does not enforce admin policy, and does not integrate with Okta or Entra. If your need is a corporate identity provider push, Duo Mobile (or Microsoft Authenticator, or Okta Verify) is the right shape and Fob is not. If your need is a personal authenticator that respects export and organization, Fob is what we are building.