If you have landed here after searching for an Authy export button, the short version is that there is not one, there never was one, and the workarounds that circulated for years mostly stopped working in 2024. That is annoying, but it is survivable, and the method that does work leaves you better organised than you started.
What Authy actually is
Authy is a hosted service, not a local vault. Your account is keyed to a phone number, your tokens live encrypted on Twilio's infrastructure, and the app's job is to show you codes without ever showing you the secrets behind them. That design is defensible from a support perspective. It is also the reason there is no export: a feature that handed you your seeds in plain text would be a feature that handed them to anyone who got into your account.
Two things changed the picture. Twilio announced in January 2024 that the Authy desktop apps for Windows, macOS and Linux would be discontinued, originally in August; the date was then brought forward to 19 March 2024. And Authy's own help content moved into Twilio's general help centre, which is where you now end up if you go looking for migration instructions.
So Authy today is a phone-only app, with no export, attached to a phone number.
The methods you will find, and what is left of them
The desktop-app script. For years the standard answer on GitHub and Hacker News was a script that opened the Authy desktop app's developer console and read the token secrets out of its local storage. It worked well. It also depended entirely on an application that no longer exists. If you still have an old desktop install that has not been wiped, you may get one last run out of it. Nobody should plan around that.
Rooted-device and backup-extraction routes. Technically possible on some Android builds, and a bad trade. You are rooting the device that holds your second factor in order to avoid an evening of clicking.
Anything that asks for your Authy credentials. There is a small industry of sites and tools offering to "migrate your Authy tokens". Handing over the credentials to your 2FA provider is the single worst thing you can do with them. Close the tab.
Re-enrolment. Unglamorous, reliable, and the only method that does not depend on someone else's bug. This is the one.
Re-enrolling, properly
Do the preparation first. It is most of the work.
- Make the list. Open Authy and write down every account it holds. Do this before you change anything, because once an account is re-enrolled you lose the prompt that reminds you it existed.
- Sort by blast radius. Your email account first, then anything that can reset other passwords, then your money, then everything else. If you run out of patience halfway, you want to have run out at the bottom of the list, not the top.
- Install the new app and have it ready. You want to be scanning within seconds of the QR code appearing, not hunting through menus.
Then, for each account:
- Sign in to the service and find its two-factor or security settings.
- Disable the existing authenticator. Most services require a current code to do this, which is why Authy stays installed.
- Immediately re-enable it. Scan the new QR code with your new app.
- Confirm with a generated code so the service marks the method as verified.
- Download the fresh recovery or backup codes and store them somewhere you can reach without the app. The old set stops working the moment you re-enrol.
- Only then move to the next account.
Two details save pain. If a service offers to show the setup key as text rather than a QR code, take it: text can be checked for typos and a camera cannot. And if a service lets you register two authenticators at once, register both before removing anything, which turns a cutover into a rollback.
If the new app starts producing codes a service will not accept, stop before you remove anything from Authy and read why a 2FA code stops working. Half-finished migrations are the most common way to end up with two entries for one account, only one of which is still live.
Why this is the moment to organise
You are about to touch every account you own, one at a time, and then never look at them in that detail again for years. It is the only cheap opportunity you will get to file them.
KeyNesta is built for the point where a flat list of codes stops working. Entries go into spaces (work, personal, servers), spaces hold groups that nest as deep as you want (AWS → Production), tags cut across the whole structure for the things a folder tree cannot express, and a separate vault — its own passphrase, its own master key, its own sync account — is there for anything that has to be genuinely separate from the rest. Search is ranked over the entry name, issuer, account name, tags and the full group path, so typing prod aws finds the production root account without you remembering where you filed it.
The practical parts for a migration: the web app runs in any browser with no install and no sign-up, so you can do the whole evening on the machine you are already signed in to rather than on a phone. There is no phone number anywhere in the product. Sync is optional and zero-knowledge — each entry is encrypted on your device before it leaves, and the server holds ciphertext it cannot decrypt. And the export you could not get from Authy is a plain standard file, available whenever you want one, including on the way out.
Being honest about the gaps, because you are mid-migration and should not be surprised later: KeyNesta is not open source, it has not had an independent security audit yet, there are no shared or team vaults, and the iPhone and Android apps are built but still waiting on their store review queues — today the product is the web app. The 2FA backup and sync guide covers how backups and sync actually work, and all shipped features includes the list of what is not built.
One last thing: when you are finished, keep the list you made at step one. Next time you move, it is the whole job.
Common questions
Is there any official way to get my tokens out of Authy?
No. Authy has never shipped an export feature, and Twilio's own documentation does not describe one. The seeds sit encrypted in Authy's storage and the app does not reveal them, so the only reliable exit is to re-enrol each account with the service that issued it.
Do the old Authy export scripts still work?
Mostly not. The best known community method read the tokens out of the Authy desktop app's local storage, and Twilio retired the desktop apps on 19 March 2024. Anything that depends on that app is gone, and anything that asks for your Authy credentials is asking you to hand your second factor to a stranger.
How long does re-enrolling every account actually take?
About one to three minutes per account once you have the pattern: sign in, open security settings, turn 2FA off, turn it back on, scan the new QR code, confirm, save the fresh backup codes. Twenty accounts is an evening. The upside is a complete inventory of what you are actually protecting.
Should I delete Authy before or after I finish?
After, and not immediately. Keep Authy installed and working until every account has been re-enrolled and you have signed in to each one with a code from the new app. An authenticator you have stopped trusting is still a better backup than no backup at all.