Recovering Google Authenticator keys from Android device for backup

howto-recover-google-authenticator-keys.txt

### Last tested February 7 2014 on a Galaxy S3 (d2att) running Cyanogenmod 11 nightly, with Google Authenticator 2.49.

### Device with Google Authenticator must have root.
### Computer requires Android Developer Tools and SQLite 3.

### Connect your device in USB debugging mode.

$ cd /tmp
$ adb root
$ adb pull /data/data/com.google.android.apps.authenticator2/databases/databases
$ sqlite3 ./databases "select * from accounts" > /Volumes/TRUECRYPT_ENCRYPTED_VOLUME/google_authenticator_backup.txt
$ rm ./databases

### If you look at the file, you see a pipe-delimited file with entries looking like the following.
### The X's mark the key.

1|Google:me@gmail.com|XXXXXXXXXXXXXXXXXXXXXXXX|0|0|0||
2|Google:me@domain.org|XXXXXXXXXXXXXXXXXXXXXXXX|0|0|0|Google|Google:me@domain.org
3|Dropbox:me@gmail.com|XXXXXXXXXXXXXXXXXXXXXXXX|0|0|0|Dropbox|Dropbox:me@gmail.com

### To restore the keys, you can key them in manually in Google Authenticator:
### Menu -> Set up account -> Enter provided key. 
### Enter the key exactly as it appears, case sensitive, and choose Time-based.

It's interesting that the length of the keys varies wildly, from 16 to 52 (presumably base64) characters.

Hi there,
Can I still recover it when I've lost my phone, and simply install the Google Authenticator on any other andriod and play with the "com.google.android.apps.authenticator2" in the root to generate/recover a key for my account.
BR

if you lost your phone and happen to have a titanium backup of your data you might be able to recover it. Otherwise: no.

I needed this to go from Google Authenticator to Authy. I wasn't able to do adb root, it said something about can't be done in a production environment. But I was able to use the info to grab the "databases" file using Root Explorer and then pop it over onto a linux box to run the sqllite3 command.

Ok I need help! I have my phone rooted but i don't understand what to do above. I have a samsung s5, I hard reset my phone but my google account restored all my applications including google authenticator but it didn't keep all my keys from the websites. I really need help! Someone explain specifically how to obtain this on a phone that was recently formatted but it still has root.

Thank you very much!!
I have a rooted m8 and successfully restored my Neteller key (I was locked out for few hours after installing new rom)
I extracted my TWRP backup on my PC (change the extension to .tar/ open with winrar or so)
Copied the file data.ext4.win000.tar\data\data\com.google.android.apps.authenticator2\databases\databases
To
\data\data\com.google.android.apps.authenticator2\databases\ on my Android using "ES File Explorer"
(Maybe you'll need to check "Root Explorer" in settings to access "data/data/"
OBViously, this will overwrite any previous codes (I had none anyway)

If you have python and the 'qrcode' module installed, you can use this to generate QR codes from the sqlite database:

import qrcode
import sqlite3
conn = sqlite3.connect('databases')
c = conn.cursor()

for idx, (email, secret, issuer) in enumerate(c.execute("SELECT email,secret,issuer FROM accounts").fetchall()):
    url = 'otpauth://totp/{}?secret={}&issuer={}'.format(email, secret, issuer)
    print url
    im = qrcode.make(url)
    im.save('{}.png'.format(idx))

Be sure to treat the qrcode images as secret (remove them when you're done!).

Thanks a lot!

to make the python script above working with google authenticator from fdroid issue must be removed

#! /usr/bin/env nix-shell
#! nix-shell -i python3 -p python3 python3Packages.qrcode

import qrcode
import sqlite3
conn = sqlite3.connect('databases')

c = conn.cursor()
for i, (email, secret) in enumerate(c.execute("SELECT email, secret FROM accounts").fetchall()):
    url = 'otpauth://totp/{}?secret={}'.format(email, secret)
    print(url)
    im = qrcode.make(url)
    im.save('{}.png'.format(i))

I don't have root and my phone has a locked bootloader. What can I do? There is another app that you can use to extract saves without root. Will that work?

Hello,
I did a phone backup without having rooted my phone, because I did a factory reset. Now I have the file com.google.android.apps.authenticator2.db (no /database) which I cannot open to extract my old authenticator codes.
Do I need to root my phone, and then somehow insert this file into the new backup to maybe be able to recover it via TWBR? Thank you!

Here's a version of the script if you need to edit or recover the issuer field:

import qrcode
import sqlite3
conn = sqlite3.connect('C:/Users/Zian/Documents/databases')
c = conn.cursor()

for idx, (email, secret, issuer) in enumerate(c.execute("SELECT email,secret,issuer FROM accounts").fetchall()):
    if issuer==None:
        if len(email.split(" "))>0:
            issuer=email.split(" ")[0]
        else:
            issuer=email

        if len(issuer.split(":"))>0:
            issuer=issuer.split(":")[0]
        
        print("If the following issuer looks wrong, enter a new value. If it's OK, just press ENTER.")
        newIssuer=input(issuer)
        if len(newIssuer)>0:
            issuer=newIssuer
    url = 'otpauth://totp/{}?secret={}&issuer={}'.format(email, secret, issuer)
    print (url)
    im = qrcode.make(url)
    im.save('C:/Users/Zian/Documents/qrcodes/{}.png'.format(idx))

Here is a new version, with terminal QC code: (comment out some line)
genqrcodes.py:

import pyqrcode
import sqlite3
conn = sqlite3.connect('/home/user/databases')
c = conn.cursor()

for idx, (email, secret, issuer) in enumerate(c.execute("SELECT email,secret,issuer FROM accounts").fetchall()):

if issuer==None:

    if len(email.split(" "))>0:
        issuer=email.split(" ")[0]
    else:
        issuer=email

    if len(issuer.split(":"))>0:
        issuer=issuer.split(":")[0]

    #print ("If the following issuer looks wrong, enter a new value. If it's OK, just press ENTER.")
    #newIssuer=input(issuer)
    #if len(newIssuer)>0:
    #    issuer=newIssuer

url = 'otpauth://totp/{}?secret={}&issuer={}'.format(email, secret, issuer)
im = pyqrcode.create(url)
#print (url)
#print(im.terminal(quiet_zone=1))

big_code = pyqrcode.create(url, error='L', version=27, mode='binary')
big_code.png(issuer+'.png', scale=6, module_color=[0, 0, 0, 128], background=[0xff, 0xff, 0xcc])
big_code.show()

does anyone know how to open .enc file

could someone plzz tell how to import qrcode and sqlite3
i have installed anaconda

This still works on version 5.10, that was released in april 2020. Thanks

Really thanks. You just save my life. Still works.

Unfortunately, this no longer works as of 12.07.2022. The secret in database seems to be encrypted somehow, and authenticator doesn't want to accept it (says + and / are invalid characters). Secrets are between 61 and 83 characters long in my case. I created my own secret to find out how it's encrypted, but I didn't succeed.
Example: Secret TEST1234TEST1234TEST1234TEST1234
gets encrypted to:
JoSYvgknFqwiMMQqEKbeZtPQ8gBppUdTbArhnsN3+fCAua0UqfqYHVHYchNWwyvSDY/BoHmUQsgRgf6W.
Lucky patcher or manual copying and pasting database file does not work - authenticator simply does not show the codes.
Also, QR codes generators don't work, as they try to create a QR code with this weirdly encrypted secret.

Just here to confirm the same issue as blazej222, manual backup of Google Auth database did not allow me to restore any keys.

ugh, I also just got hosed by this issue where the account.secret column is encrypted. The fact that Google Auth has no easy transfer (the QR Code way does not work if you are trying to flash your phone with the latest Android OS... and they don't even allow you to screenshot it!).

I've lost access to probably 20-30 services now. Thankfully had an export of my bitwarden vault.

If anyone finds the private key location (and hopefully its in one of the files that I backed up of the Authenticator's app data), maybe there is hope.

A solution with the encrypted accounts.secret column, there is in https://github.com/scito/extract_otp_secret_keys

Link is dead

copy and paste the link instead, but he didn't specify how he did the simulated restore but then again I don't really understand sqlite3 that well.

copy and paste the link instead, but he didn't specify how he did the simulated restore but then again I don't really understand sqlite3 that well.

he did mention the procedure at scito/extract_otp_secrets#24 , but the solution is misleading.
his solution is based on database of google authenticator version prior 5.10 which doesn't encrypt the secrets.
so the problem of encrypted secrets still persists.

I searched Google and accidentally found this website that can decode secrets from the newer Apps. I tested myself and it did work.

I searched Google and accidentally found this website that can decode secrets from the newer Apps. I tested myself and it did work.

It requires the QR codes, so it doesn't decrypt them "just by the database file".

You can try disabling selinux. Tried the earlier suggestions, but Authenticator kept crashing. Restoring through Titanium backup that way, while upgrading from Android 10 to Android 13, I managed to recover my passwords.