It can definitely be annoying when you have many codes already stored in it, but the long term solution is: don't use Google Authenticator. There are better alternatives such as andOTP / FreeOTP, Authy, or password managers such as 1Password or Bitwarden (paid version) can handle TOTP codes too.

Doesn't help you now but I can highly recommend AndOTP [1]. It's an opensource OTP app with support for encrypted backups/restores for your 2FA codes.

[1] https://github.com/andOTP/andOTP

I have switched Android phones about 10 times and I have never successfully used the Google-made backup. Here's why, I think:

Old phone is on Android N. Backups happening regularly by their service. Phone breaks or I get a new phone. New phone is running Android N-1. In the setup process it tries to use the backup and it fails, of course, because it's from a newer version of Android. Every. Single. Time. What I should have done, and I ALWAYS FORGET: do not login to your account until you have fully updated the phone to the latest Android version!

Google disabled backups for their Authenticator app so I don't think they will ever let you export the secrets.

I wrote an application to automate OTP secret extraction for just about every app out there after trying to migrate a few dozen tokens from Google Authenticator to AndOTP. You might find it useful: https://github.com/puddly/android-otp-extractor

Dont you need root access to get the app private data?

I switched from Microsoft to Google because they advertised as having backup and now I am stuck with Google authenticator without any backup.

The only saving grace for Android was adb backup and restore but Google is shutting that down

You do need root access, unfortunately. Even backing up the filesystem with `tar` is troublesome: https://github.com/dlenski/tetherback

I really hoped Google would have allowed some way to locally make full Android backups by now but I guess that's not compatible with their business model.

That part may be by security design. The purpose of "something you have" is that it is something that can't be trivially copied.

My workaround is to record the codes offline before entering them in Authenticator (essentially printing them out and putting in my fire safe). This also allows me to easily put them into other devices (such as upgrading phones, or on a Yubikey).

It can not be trivially copied because it's on my pocket. One can improve on this, and compose with a necessary password, that I know, and erasing the data after too many wrong guesses.

How does making it hard for me to get my data from my phone improve on my security?

Because if you can't get the data off your phone, you can't undermine the part where it can not be trivially copied because it's on your pocket.

Once they get the data off a phone the user can upload it to reddit or whatever stupid idea someone might have.

If you're on a rooted Android device, you could backup the entire img with Nandroid [0], or backup apps and data using Titanium Backup [1].

[0] https://android.stackexchange.com/questions/104852/how-do-i-...

[1] https://play.google.com/store/apps/details?id=com.keramidas....

I would suggest using another app like Authenticator+ that has encrypted cloud sync. It's saved me a ton of trouble over the last few years.

I'm not sure about Authenticator+ as I haven't used it, but I did use Authy. I ran into nearly the same issue when I wanted to migrate to Bitwarden - it was difficult to extract my TOTP secrets. I ended up having to write some Javascript code that would extract them for me.

Do use an encrypted cloud sync but make sure that it doesn't create a similar problem.

In this case, Authenticator+'s cloud sync is just an encrypted sqlite DB (with dirt-simple schema) that gets uploaded to Google Drive (I believe there are also other options for upload target). So it's pretty trivial to migrate to other services.