Executive Overview: The New Phone Lockout Trap
Upgrading to a new flagship smartphone is exciting—until you factory reset your old phone, open your crypto exchange or work portal on the new device, and realize your two-factor authentication (2FA) authenticator app is completely blank. Every year, thousands of users permanently lose access to their primary emails and banking apps. Follow this rigorous security checklist to transfer all TOTP keys and FIDO2 passkeys with zero risk.
1. Rule Zero: Never Wipe Your Old Phone First
The single most catastrophic mistake is executing a factory reset on your trade-in device before thoroughly verifying every critical account on your new device. Keep both phones powered on side-by-side until you have completed every step below.
Figure 1: Hardware FIDO2 cryptographic tokens and cross-platform biometric passkey synchronizers.
2. Transferring Authenticator Apps (By Platform)
A. Google Authenticator:
- On your old phone, open Google Authenticator > tap the menu / profile icon > tap Transfer accounts > Export accounts.
- Select all accounts you wish to migrate. The app will generate an encrypted batch QR code.
- On your new phone, install Google Authenticator > tap Transfer accounts > Import accounts > scan the QR code from the old phone.
- Important: Verify that the 6-digit rolling codes match exactly on both screens before deleting.
B. Open-Source Aegis Authenticator (Android):
- Open Aegis > Settings > Export.
- Select Aegis Encrypted (JSON) and enter a strong master password.
- Send the
.json file to your new phone via local USB cable or encrypted messaging.
- Open Aegis on your new phone > Settings > Import > decrypt with your password.
C. Ente Auth / Bitwarden Authenticator (End-to-End Encrypted Cloud):
Both Ente Auth and Bitwarden use zero-knowledge end-to-end encryption. Simply log in on your new phone and enter your 24-word recovery seed phrase. All 2FA tokens decrypt immediately across both devices in real time.
3. Migrating FIDO2 Passkeys (Apple Keychain vs. Google Password Manager)
Passkeys replace passwords with public-key cryptography. How they migrate depends on your ecosystem:
- iOS to iOS: Synced automatically via iCloud Keychain (protected with end-to-end encryption derived from your device passcode).
- Android to Android: Synced automatically via Google Password Manager with your Google Account encryption key.
- Cross-Platform (iOS <-> Android): Passkeys stored in proprietary OS keychains do not cross operating systems easily. To maintain platform independence, store your passkeys inside an independent cross-platform password vault like 1Password or Bitwarden.
4. The 5-Point "Safe to Wipe" Verification Checklist
- ☑ Test Primary Email: Successfully log into your Google / Microsoft account on the new phone with 2FA approval.
- ☑ Test Bank & Finance: Complete one biometric transaction or login verification.
- ☑ Export Emergency Recovery Codes: Ensure you have physical printouts of your emergency 16-character backup codes stored in a fireproof safe.
- ☑ De-register Old Hardware Keys: If you use WebAuthn keys, update your account security settings.
- ☑ Only Now: Trigger the factory data reset on your old smartphone.
Frequently Asked Questions (FAQ)
What should I do if I already wiped my old phone and lost my 2FA codes?
Look for the emergency backup codes you were instructed to save when you first enabled 2FA. If unavailable, use the "Try another way" option to verify identity via your backup email, SMS recovery, or account recovery ticket.
Why is SMS two-factor authentication considered dangerous?
SMS is vulnerable to SIM-swapping attacks, SS7 cellular routing exploits, and lock-screen preview snooping. Authenticator apps (TOTP) and hardware passkeys (FIDO2) are immune to cellular network interception.