Back up your 2FA codes and switch phones without panic

Published 29 August 2026, updated 19 September 2026.

Two-factor authentication protects your accounts right up until the phone holding the codes is lost, stolen, or dead. Then it locks you out. Most people discover this at the worst possible moment. It is entirely preventable with two minutes of setup: an encrypted backup you own, zero-knowledge sync, or both.

The phone is only half of it. Delete the authenticator from a phone that still works and you are in the same place, minus the drama — what a reinstall actually brings back varies enormously between apps, and in every case it is only what a backup or a sync account was already holding for you.

Option 1: An encrypted backup file you own

KeyNesta exports your whole vault as a single encrypted file: every secret, name, tag, space and group, sealed with AES-256-GCM under a key derived from your passphrase. The encryption happens before the file exists, so it is safe to store anywhere (a drive, your notes, cloud storage) because without the passphrase it is indistinguishable from random noise.

• Make one after any big change (importing accounts, adding a bank).
• Store it somewhere that survives your phone: a computer, a USB stick, a cloud drive.
• Backup files are created and restored in the web app; it takes about a minute. Phones then receive the restored vault through sync.

Option 2: Zero-knowledge sync

Enable sync and your vault lives on every device you sign in on, kept consistent automatically. Each entry is encrypted on your device before upload; the server stores ciphertext plus sync bookkeeping (IDs, versions, timestamps) and nothing else. Your vault passphrase never leaves your devices, which also means a synced copy is not a weaker copy.

This is also how you get codes in two places at once — a second phone, or a phone and the laptop you work on — without copying a secret around by hand: an authenticator app on two devices compares that route with scanning the same QR twice and with re-enrolling.

Moving to a new phone, step by step

1. Before the old phone goes anywhere: make a fresh encrypted backup in the web app, or confirm sync is on and green.
2. On the new device, open the web app (or install the KeyNesta phone app once it is in the stores).
3. Restore the backup file in the web app, or sign in to sync, then unlock with your vault passphrase.
4. Spot-check codes against the old device for your critical accounts.
5. Wipe the old phone as you normally would. Done. No account-recovery marathons.

The one rule that matters

Zero-knowledge means nobody can reset your passphrase: not support, not anyone. That is what makes the backups trustworthy, and it makes the passphrase itself the thing to protect: keep it in a password manager, or written down somewhere genuinely safe. Everything else is recoverable.

Frequently asked questions