2FA Authenticator App With Backup: 5 Questions to Ask Before You Trust One

Your 2FA codes are not stored anywhere you can see. Each 6-digit code is calculated from a secret key that lives inside your authenticator app, plus the current time. Lose the phone without a backup of those secrets and every code goes with it. A 2FA authenticator app with backup fixes that, but only if you can answer 5 questions about it: where the backup is stored, who can decrypt it, what you need to restore it, whether it works offline, and how it exposes codes on screen.

Short answer: Your 2FA codes are generated from secret keys stored in your authenticator app. If the phone is lost and those secrets weren't backed up, you'll need each site's recovery codes to get back in. A good authenticator keeps an encrypted backup only you can unlock. Zelf Auth encrypts 2FA secrets with your face and backs them up on IPFS.

This guide explains how the codes work, what happens when a phone disappears, the checklist to judge any backup, and how Zelf Auth handles it.

How authenticator codes work

Most authenticator apps use TOTP, the time-based one-time password standard described in RFC 6238. When you scan a site's QR code, the app saves a shared secret. From then on, the app and the site each combine that secret with the current time and produce the same short code, which changes every 30 seconds or so.

That has one important consequence: the code is disposable, the secret is not. Anyone who has the secret can generate your codes forever, and if you lose the secret, nothing can regenerate it for you. Protecting and backing up 2FA really means protecting and backing up those secrets.

What happens to your 2FA codes when you lose your phone

If your authenticator kept its secrets only on that phone, they are gone with the device. A new phone with the same app installed starts empty. To get back into each account you'll need one of these:

The recovery codes the site gave you when you turned on 2FA.
Another sign-in method you set up earlier, such as a security key or a second authenticator.
The site's account recovery process, which can take days and may ask you to prove your identity.

Multiply that by every account that used the app, and one lost phone can lock you out of many accounts at once. The same logic applies to crypto wallets: we explain it in what happens to your crypto if you lose your phone.

Do this today, before anything goes wrong

Two quick checks protect you from the worst case:

Save each site's recovery codes offline. Print them or write them down and keep them somewhere safe. If you never saved them, most sites let you generate a new set in their security settings.
Check whether your current app has any backup at all. Open its settings and look for backup, sync, export or transfer options. If you find none, your 2FA secrets exist on one device only.

Turning on multi-factor authentication is still the right move. CISA's guidance on MFA recommends it for every account that offers it. The goal is to make it survivable when a device fails.

5 questions to ask about any authenticator's backup

Use this checklist on whatever app you use now, or any app you're considering:

Where is the backup stored? Only on the device, in a company's cloud tied to an account, or in storage you control?
Who can decrypt it? If the provider or anyone with your account password can read your secrets, the backup is only as strong as that account.
What do you need to restore it? An account login, a separate backup password, your face? Make sure you will still have it after losing the phone.
Does it work offline? Codes should still generate without a connection, and access shouldn't depend on a server being up.
How are visible codes exposed on screen? Codes shown in plain view can be read by anything that can see your screen.

NIST SP 800-63B is a useful reference if you want the formal guidance on how authenticators should be protected and replaced.

Cloud-synced backups: convenient, but tied to an account

Several popular apps solve the lost-phone problem by syncing to an account. Google's help page explains that Google Authenticator can sync your codes to your Google Account, and Microsoft documents how to back up and recover account credentials in Microsoft Authenticator through a personal account.

That is a big improvement over a device-only app. The trade-off is that your 2FA secrets now depend on that account: its password, its recovery options and how the provider encrypts the backup. Before relying on sync, check questions 2 and 3 above. We looked at what happens when the account layer itself is the weak point in our earlier piece on 2FA failures.

Why the screen matters too

Backups aren't the only risk. Researchers behind Pixnapping showed that a malicious Android app could read sensitive data off the screen, and that their attack against Google Authenticator could steal 2FA codes in under 30 seconds while hiding the attack from the user.

The lesson for any authenticator: keep your phone updated, install apps only from sources you trust, and prefer apps that don't leave every code sitting on screen longer than needed.

How Zelf Auth backs up your 2FA

Zelf Auth is a decentralized 2FA authenticator protected by HumanAuthn. Here is how it answers the backup questions, in 4 steps:

Create or import your 2FA accounts. You add OTP-based accounts the same way you would in a standard authenticator app.
Encrypt them with HumanAuthn. Your 2FA secrets are encrypted and decrypted through HumanAuthn biometric encryption, so access is tied to your face. They stay encrypted at rest.
Store them on IPFS. Encrypted 2FA data is stored through IPFS, decentralized-first storage, rather than only on a company's servers. Recovery keys are kept as encrypted QR codes on IPFS.
Recover with your Zelf ID. Securing a Zelf ID is what lets you get back in after a lost phone. Registering a Zelf ID name is free.

Zelf Auth also works offline, doesn't require a phone number or email address, and is open-source. The same biometric approach protects passwords in the Zelf password manager, which we cover in Zelf Keys, the biometric password manager. If you want to understand the biometric layer itself, read what ZelfProof is. When you're ready, download Zelf Auth and add your first 2FA account.

Device-only vs cloud-synced vs Zelf Auth

	Device-only authenticator	Cloud-synced authenticator	Zelf Auth
Where the backup lives	Nowhere, unless you export it yourself	The provider's cloud, linked to your account	Encrypted on IPFS
Who can decrypt it	Whoever holds the phone and unlocks it	Depends on the provider's encryption and your account security	Your face, through HumanAuthn
What you need to restore	Recovery codes for each site	Your account login and its recovery options	Your Zelf ID and a face verification
Offline use	Yes	Codes yes; restore needs the account	Yes

Whichever type you choose, keep each site's recovery codes offline. If you back up a crypto wallet too, the same principles apply: see how to back up a crypto wallet safely.

Quick answers

What happens to my 2FA codes if I lose my phone? If your authenticator kept its secrets only on that phone, the codes are gone with it. You'll need each site's recovery codes, another sign-in method you set up earlier, or the site's account recovery process. An authenticator with an encrypted backup lets you restore the secrets on a new device instead.

Can I back up the codes in my current authenticator app? It depends on the app. Some keep secrets only on the device, others sync them to an account in the provider's cloud, and some let you export them. Open the app's settings and look for backup, sync or transfer. Then check who can decrypt that backup and what you'd need to restore it.

Are cloud backups of 2FA codes safe? They can be, but their safety depends on how the backup is encrypted and who holds the key. If anyone with your account password can restore your 2FA secrets, the backup is only as strong as that account. Protect the account with a strong password and its own second factor, and keep recovery codes offline.

What are 2FA recovery codes and where should I keep them? Recovery codes are one-time backup codes a site gives you when you turn on two-factor authentication. Each works once, so you can sign in if you lose your authenticator. Store them offline, printed or written down, somewhere safe and separate from your phone. If you lost them, most sites can generate a new set.

Does Zelf Auth work offline? Yes. According to the Zelf Auth product page, the app works offline, so your 2FA codes are available on your device anytime and anywhere, without depending on a connection. Your 2FA secrets stay encrypted at rest and are protected by HumanAuthn biometric encryption, with encrypted backups stored on IPFS for when you need to recover.

Do I need a phone number or email for Zelf Auth? No. Zelf Auth doesn't require a phone number or an email address. Access is tied to HumanAuthn biometric encryption and to your Zelf ID, which is what you secure to recover your 2FA accounts after losing a phone. Registering a Zelf ID name is free, and Zelf Auth is open-source.

Set up a 2FA backup before you need it

Save your recovery codes today, then move your 2FA accounts to an authenticator whose backup only you can unlock.

Download Zelf Auth