Google Authenticator Export QR: Decoding otpauth-migration and Extracting Your Secrets
Updated Nov 2026 · ~6 min read
When you switch phones, keep a backup, or migrate from Google Authenticator to more flexible apps like Aegis or 2FAS, Google's "Export accounts" feature generates a QR code. That code contains the complete secrets of every selected account — but wrapped in Google's proprietary otpauth-migration:// protobuf format, so ordinary scanners only show an unusable link.
This guide covers three things: how to export correctly, what the export payload actually contains, and how to turn it into usable Base32 secrets with the 2fa.pub online decoder without ever leaking a secret.
1. Exporting accounts from Google Authenticator
- Open Google Authenticator → top-right ⋮ → Settings (older versions: "Transfer accounts")
- Choose "Export accounts"
- Select the accounts to export (multi-select) → Next
- The app renders a QR code — this is the export payload, containing the full secrets of the selected accounts
iOS and Android differ slightly in menu layout but produce the identical export format. Some banks and enterprise SSO providers disable export; those entries never appear in the payload.
2. What's actually inside the export code?
Scanning the QR with any reader yields text like:
otpauth-migration://offline?data=CiUKIEkR4IknrfoK...（Base64URL encoded）
The data parameter is a Base64URL-encoded protobuf message. After decoding, each account entry (OtpParameters) carries six fields:
| Field | Meaning | Example |
|---|---|---|
| 1 | secret (raw key bytes) | 16-20 binary bytes |
| 2 | name (account label) | [email protected] |
| 3 | issuer (provider) | GitHub |
| 4 | algorithm (enum) | 1 = SHA1, 2 = SHA256, 3 = SHA512 |
| 5 | digits (enum) | 1 = 6 digits, 2 = 8 digits |
| 6 | type (enum) | 2 = TOTP, 1 = HOTP |
Standard Base32-encoding (RFC 4648, alphabet A-Z2-7) of the secret bytes gives the familiar key form used by every authenticator, e.g. JBSWY3DPEHPK3PXP.
3. Extracting secrets online with 2fa.pub (local computation, zero uploads)
- Open the 2fa.pub Google export decoder
- Paste the entire
otpauth-migration://offline?data=...string, or upload a screenshot of the export QR (Ctrl+V paste works too) - The table instantly lists each account's issuer, name, Base32 secret and algorithm parameters
- Hit "Send to calculator" to compute all codes live, or use the built-in QR generator to convert secrets back into standard otpauth:// QR codes for any other app
Decoding happens entirely in your browser — 2fa.pub is a pure front-end tool with no backend to receive secrets, and the page's live network audit lets you verify that yourself. You can also convert secrets into phone-scannable otpauth:// images with the 2FA QR generator.
4. Frequently asked questions
Is the export code safe? The export payload equals every secret in plaintext — treat it like writing all your passwords on one sheet of paper. Never share screenshots and never decode it with untrusted online tools. 2fa.pub decodes everything locally in the browser, which is the fundamental difference from other online decoders.
Can I import into other authenticators? Yes. With the Base32 secret in hand, any otpauth://-compatible app can rebuild the entry.
What about Steam? Steam uses its own Steam Guard protocol (shared_secret / maFile), not Google's export. The 2fa.pub Steam calculator accepts a pasted maFile and computes the 5-character token.