How to Extract TOTP Secrets from Google Authenticator

When setting up two-factor authentication (2FA) using Google Authenticator, it may seem convenient to scan a QR code to link your accounts. However, this approach has some security limitations that you should be aware of.

The first issue is that the QR code can be read by any TOTP 2FA app, which means that once you've scanned the code, anyone with access to that app can also use it to authenticate for your accounts. This is not a secure practice, especially if you have multiple accounts linked to Google Authenticator.

Another limitation of using Google Authenticator is that the QR code does not expire. Once you've scanned it, the secret key is stored on your device and can be accessed at any time. This means that even if you decide to stop using Google Authenticator in the future, the secret key will still be accessible to anyone who has access to your device.

To avoid these security risks, it's recommended that you use alternative TOTP 2FA apps like Authy, Aegis, or 2FAS instead of Google Authenticator. These apps provide better security and more features for managing your 2FA accounts.

If you do decide to use Google Authenticator, there is a way to extract the secret keys from the app without having to manually enter them one by one. The export feature in Google Authenticator allows you to export up to 10 accounts at a time as a QR code. This code can be read by other TOTP apps like Aegis or Authy.

The exported QR code is a string of text that looks something like this: `otpauth-migration://offline?data=CkoKDZePmX7z8qHgFlH9yVcSIlRoaXNfaXNfYW5fRXhhbXBsZTplbWFpbEBlbWFpbC5jb20aD0V4YW1wbGVfV2Vic2l0ZSABKAEwAhABGAEgAA%3D%3D`

This string of text contains the secret keys for your accounts, encoded in a way that's difficult to read. However, it's possible to extract these secrets using other TOTP apps or by using online tools.

In conclusion, while Google Authenticator may seem like a convenient option for 2FA, it's not the most secure choice. If you're looking for better security and more features, consider using alternative TOTP 2FA apps instead.

Extract totp secrets from google authenticator