Does an authenticator app transfer to a new phone?
Short answer
An authenticator app does not always transfer automatically to a new phone. Whether your accounts move over depends on the specific app and its backup settings. Because an authentication application acts as something you have, you must follow the vendor's setup process to connect your new device. You should always verify that your codes work on the new phone before deleting the app or erasing your old device.
The details
According to CISA guidance, multi-factor authentication uses a layered approach that requires two or more authenticators before granting access. An authentication application serves as something you have. This requirement prevents unauthorized users from accessing accounts even if a password is compromised. Because access is linked directly to your device, moving to a new phone requires checking how your specific application handles device changes.
To prevent account lockouts on critical email or financial services, review your application settings for backup or migration tools before switching hardware. The NCSC guidance recommends using two-step verification and backing up vital data. As a rule, never reset or trade in your original phone until you have verified that your login codes generate properly on the new device.
What to do
- Keep your old phone powered on and functional during the transition.
- Install the authenticator application on your new phone.
- Check the application settings on your old phone for transfer or export options.
- Follow the application provider's instructions to link the new device.
- Sign in to a primary account to confirm the new codes work before resetting the old phone.
Useful next reads and tools
Terms explained
- Backup (3-2-1 rule)
- A backup is a separate copy of data that can be restored after deletion, failure or attack. The 3-2-1 rule means three copies, on two types of storage, with one off-site.
- HTTPS and TLS
- HTTPS is HTTP protected by TLS encryption, which keeps data between a browser and a website private and tamper-resistant and confirms the site controls its domain.
- Multi-factor authentication
- Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.