The best time to move Google Authenticator is when both phones are on the table and you can still unlock the old one. You need to transfer the entries that generate fresh codes. Copying the six digits currently on screen buys you only a few seconds. Leave the old handset intact until you have used its replacement to sign in to the accounts you care about.
There are two ways across. Entries saved to a Google Account can appear on another phone when you sign in to that account inside Authenticator. Entries stored only on the handset need a direct transfer using the old phone and the new phone together. Start by finding out which arrangement you have, even if the same Gmail address is already on both devices.
Check the old phone and line up a way back in
Open Authenticator on the old phone. Look at the profile control at the top and check which Google Account, if any, the app is using. Read the whole email address. You might have a work account and a personal account under the same initials. If you deliberately set up Authenticator without an account, plan to use the QR transfer. Leave the existing sync setting alone while you check.
Make a short list of the services and usernames shown, including anything you use only occasionally. Record labels, never the changing numbers or setup keys. Put your main email and any password manager protected by this app near the top. Keep an established browser session open on a computer you control. That gives you somewhere to review security settings while you test a separate sign-in.
Check how you would enter the Google Account holding the synced entries if its own sign-in demanded a code. You can use the old phone during the move. For later, identify an independent method already registered, such as a security key, or locate unused backup codes somewhere accessible without either phone. If the only copy is a download on the handset going into the trade-in box, move it somewhere secure first.
Google’s backup code instructions explain how to find the option under your Google Account’s two-step verification settings. Each code works once. Generating a replacement set invalidates the earlier set, so keep an existing usable copy unless you need a replacement. These codes get you into that Google Account. Other services issue their own recovery methods.
Bring synced entries onto the new phone
Install Google Authenticator from Google Play or the App Store and open the app on the new phone. Connect to the internet and sign in inside Authenticator with the Google Account you identified on the old handset. If asked for a second step, use an available method you already set up. Once the entries appear, compare the service names and usernames with your list.
If just a few are missing, look for a second Google Account that held entries on the old phone. Add that account to the new app if appropriate. Avoid choosing the option to use Authenticator without an account on the old handset as an experiment. Switching an existing synced setup to that mode removes the saved codes from the Google Accounts and leaves them on the device.
Transfer entries kept only on the old handset
Update Authenticator on the old phone and open the official app on the new one. If you want the new phone to hold codes locally, choose the option to use it without an account during initial setup. Sit somewhere private with both devices. An export QR image contains the material needed to make future codes for the selected accounts. Keep it off screenshots, shared albums, video calls and messaging apps.
On the old Android phone, open Authenticator’s menu, pick Transfer codes, then Export codes. Unlock when asked, select the entries and continue. On the new Android phone, find Import codes under the transfer menu and use its scanner on the old screen. An iPhone may call the corresponding menu Transfer accounts and the two choices Export accounts and Import accounts.
For a large selection the old phone can display several QR images. Scan each one and look for confirmation on the receiving phone. Compare the result with your list while the old phone is still available. Google’s guides show the transfer controls for Android and iPhone. On a mixed pair, follow the export labels for the handset displaying the image and the import labels for the one scanning it.
Moving the SIM card has no bearing on these entries. Once the transfer is complete, the new app can generate codes even before you activate a mobile plan. The website where you enter them still needs a connection. You can therefore keep the SIM in the old handset for a text message you might need during setup.
Test the new codes at the services that accept them
Use a private browser window or a separate browser profile on your computer. Open the service from your bookmark or type its usual address. Sign in with the right username and password. At the verification step, choose the authenticator app if other choices appear. Enter a fresh code from the new handset, leaving enough time before it changes. Tick the entry on your list once the service accepts it.
A sign-in that completes with a passkey, a text or an approval prompt proves that method still works. To check an Authenticator entry, you need to see its code accepted. Keep the established session open throughout. If two entries have similar labels, match both the service and username before entering anything. Work through the accounts that rely on the app, especially those you cannot readily recover elsewhere.
Resolve a missing or rejected code before handover
For a rejected code, check the username again and wait for the next number. Check that the new phone sets its date and time automatically. Current Authenticator versions use the phone’s clock. If one sensible retry fails, pause and use the working session or an independent recovery method to investigate. Repeated guesses may trigger a service’s sign-in limits.
Suppose the old and new phones show the same GitHub code at the same moment, yet GitHub rejects it. Check which GitHub username you supplied in the browser. Two phones can faithfully reproduce the entry for a different login. GitHub’s own troubleshooting guide explains how the app, account setup and clock fit together.
If a local entry never arrived, check whether you selected it for export and scanned every image. If the old phone is already unavailable and the entry was local, turn to the affected service’s recovery process. A workplace help desk may need to verify your identity to restore access. Keep your other working entries intact while resolving that account.
Once your checks pass, leave the entries in Authenticator alone. Deleting a synced entry on the old phone deletes it everywhere it is synced. Back up the remaining personal data you want to keep, then follow the manufacturer’s trade-in instructions for erasing that particular device. The National Cyber Security Centre’s second-hand device guide explains the order. Put the old phone in the box only after the new one can get you back into your accounts.