Import your Aegis or 2FAS codes into KeyNesta

Published 19 September 2026. About 5 minutes.

Both Aegis and 2FAS can export their whole vault as a JSON file, and KeyNesta reads both formats directly. The import is decoded on your device; the file never touches a server. One requirement: the export must be unencrypted. KeyNesta cannot open an encrypted Aegis vault or a password-protected 2FAS backup, and it tells you so if you try.

Export from Aegis

Open Aegis, then Settings, then Import & export, then Export.
Choose the JSON format and turn off vault encryption for this export. Aegis warns that the file will contain your secrets in plain text; that is expected, and you will delete the file at the end.
Save the file somewhere you can reach from the computer running KeyNesta. Menu names may differ slightly between Aegis versions.

Export from 2FAS

Open 2FAS, then Settings, then Backup, then export to a file.
Do not set a password on the export, or KeyNesta will not be able to read it.
2FAS saves a file ending in .2fas. It is plain JSON inside.

Import into KeyNesta

Open the web app and unlock your vault.
Choose Import from another app.
Upload the file, or open it in a text editor and paste its contents into the Paste export data or otpauth URIs field. The file picker accepts .json, .csv and .txt, so either rename a .2fas file to .json first or paste its contents.
Review the preview. Every account is listed, duplicates of entries you already have are flagged and skipped, and invalid rows are marked. Confirm to import; the whole batch can be undone with one tap.

What carries over

From Aegis: issuer, account name, secret, algorithm, digits, period, HOTP counters, and groups, which become KeyNesta tags.
From 2FAS: service name, account, secret, algorithm, digits, period and counter.
Not carried over: custom icons and colours. KeyNesta generates its own avatars from the service name.

Afterwards

Delete the export file. It holds every one of your secrets unencrypted, and you no longer need it. Then create a KeyNesta encrypted backup, or turn on sync, so the migration is the last time you ever have to do this by hand. See 2FA backup and sync.

Frequently asked questions

Can KeyNesta read an encrypted Aegis vault?

No. Export the vault from Aegis as unencrypted JSON, import it, then delete the file. KeyNesta shows a clear message if you paste or upload an encrypted Aegis export.

My 2FAS file will not upload. What now?

The web app file picker accepts .json, .csv and .txt. Either rename the .2fas file to .json, or open it in any text editor and paste its contents into the import field. The content is plain JSON.

Do groups and icons carry over?

Aegis groups become KeyNesta tags. Icons and custom colours from either app are not imported; KeyNesta draws its own avatars.

Is the export uploaded anywhere?

No. The file is parsed in your browser and the entries are written into your encrypted vault on the device. If sync is on, only the encrypted result is uploaded.

Try KeyNesta free. The web app needs no sign-up.

Open the web app All platforms