Migrate from Microsoft Authenticator to TwoFac

Why is this manual?

Microsoft Authenticator does not provide a built-in "Export" feature to move accounts to other apps like Google Authenticator or TwoFac. This is designed as a security measure but creates a vendor lock-in scenario, making migrating away from the app difficult.

Step 1: The Manual Method (Recommended)

The standard and safest way to move your accounts is to manually re-register them in TwoFac.

1. Log in to each service (e.g., Google, GitHub, Facebook) using your current Microsoft Authenticator code.
2. Go to the Security / 2FA Settings of that website.
3. Disable 2FA temporarily, and then Re-enable it.
4. When the website shows a new QR Code, scan it with the TwoFac app.
5. Test the new code to make sure TwoFac is correctly registered.
6. Delete the old entry from Microsoft Authenticator once you've confirmed TwoFac works.

Tip: Don't forget to save the Recovery Codes provided by the websites when re-setting up 2FA!

Step 2: Securing Your New TwoFac Setup

Now that your accounts are finally free from vendor lock-in, make sure to secure them:

• Enable Biometric Lock in TwoFac to ensure only you can access your codes.
• Create an Encrypted Backup of your accounts to avoid ever needing to perform manual re-setup again! Store the backup securely.

Advanced: The "Rooted Android" Method

If you are a power user with a rooted Android device or comfortable using an Android emulator, you can extract the database file where Microsoft stores the secrets.

1. Enable "Cloud Backup" in Microsoft Authenticator on your phone, then restore that backup onto a rooted Android device or emulator.
2. Use a file explorer with root access to locate the database at: /data/data/com.azure.authenticator/databases/PhoneFactor.
3. Extract this file and open it with an SQLite browser.
4. Look for the accounts table. The oath_secret_key column contains the raw TOTP seeds, which you can manually add to TwoFac by copying the secrets.