One-Time Password Secret Extractor

Google Authenticator lets you transfer your accounts to a new phone, but it doesn't provide an easy way to export them to other apps like 1Password or Bitwarden. This is because it hides the original "secret" (the QR code you first scanned) for each account.

Without these secrets, moving to a new password manager means manually re-configuring 2FA for every single account, which is a huge pain.

While other tools exist to solve this, they often require technical steps like running scripts or installing software. This tool is designed to be a simple, secure solution that anyone can use.

You scan the QR codes from Google Authenticator or LastPass Authenticator's export feature with your camera, or provide screenshots of them (or a LastPass export file). This tool reads those QR codes—right here in your browser—and gives you back the original secret for each account. You can then use these secrets to import your accounts into any other authenticator app.

Yes. Security and privacy are the top priorities. Nothing you do here ever leaves your computer or mobile device. All processing happens locally, offline, right in your browser. Your QR code images and secrets are never sent to any server.

For the most privacy, open this tool on your computer or a second device, and click "Scan QR" to scan the export QR codes on your phone directly, without taking screenshots.

Note: Any screenshots or downloaded files contain your unencrypted secrets. Be sure to store them securely, or delete them when you are done. This includes deleting them from your "Trash", "Recycle Bin", "Recently Deleted" and any cloud photo backups.

This tool is open-source and the code can be inspected by anyone, to verify its safety and methodology. It is hosted on GitHub pages, providing a secure and transparent deployment process.

Google Authenticator makes it difficult to view the original secrets used to set up your accounts. Instead, they provide an export QR code that bundles all your accounts together. This makes it easy to transfer to a new device, but difficult to switch to a different authenticator app. LastPass does provide individual QR codes for each account, which is a huge improvement, but it only provides the text secrets in a JSON code format. In contrast, apps like 1Password make the original secrets easily accessible, allowing for simple transfers to other 2FA apps.

That's a great question, and one that others have asked. One reason given is a concern that Google's export format might change. However, this format has been stable for years, and other apps (like Aegis Authenticator) support it without issue. It seems password managers like 1Password could easily support direct imports, but have chosen not to.

LastPass puts all of your accounts together into one QR code, and if you have many accounts this can make the QR code details tiny and hard to read. Google Authenticator works around this issue by providing more than one code, each containing a few accounts. Luckily, LastPass allows you to export a json file, which this tool can also read. If you're having problems with LastPass, just save the json file and import that instead.

This tool was created by Matthew Carroll, a developer who was frustrated with the process of migrating OTP codes from Google Authenticator into 1Password.

Please report any issues with this tool on GitHub.

This tool builds on the work of several open-source projects, including:

• Extract OTP Secrets, the python script by Roland Kurmann, on which this tool is based.
• Aegis Authenticator and Chris van Marle, for the export protobuf specification.
• Google Authenticator Exporter, another python script solution to the same problem.

The user interface and QR code processing are powered by these open-source libraries:

• jsQR for decoding QR codes from images.
• pica for high-quality image resizing.
• QR Scanner for scanning QR codes using the camera.
• protobuf.js for decoding the Google Authenticator data payload.
• node-qrcode for generating new QR codes for each account.
• thirty-two for Base32 encoding the OTP secrets.
• Font Awesome for the icons used in the UI.

Thank you to all the contributors to these excellent projects!

Translations were written and reviewed by: T12 (Română), n66g4 (简体中文).

Gemini Code Assist and Claude Code were used during the development of this tool. All AI-generated code has been carefully manually reviewed.

For the people and places you love

The development of this tool was made possible in part through the support of Stand.earth. If you find this useful, please consider making a donation to support Stand's work.