← Notes

Migrating Away from Authy

Authy has no official export button, so getting your own TOTP secrets out means intercepting its own API traffic. Both Android and iOS work; iOS with mitmproxy is the less painful route.

Last updated August 30, 2026

Line drawing of a smartphone showing a one-time-password code beside a key

Authy will happily hold your 2FA seeds hostage forever if you let it. There's no "export" anywhere in the app — every route out involves reading the encrypted token blob off the wire or off a rooted device, then decrypting it yourself with your backup password.

Android options

If you've already got a rooted phone (or don't mind rooting an emulator), this avoids mitmproxy entirely:

Bypassing Authy's device integrity checks on a rooted phone with Magisk modules (PlayIntegrityFix, TrickyStore, Integrity Box) to pass Play Integrity, log into Authy, then pull the codes out with an app like Aegis.
Rooting an Android Virtual Device with Magisk, using the rootAVD script, if you'd rather root an emulator than a real phone.
Interacting with a rooted AVD once you've got root, to actually get at Authy's data.
Ditching Twilio Authy: a TOTP export walkthrough once root is sorted.

Whichever Android route you take, Aegis is the recommended app to land the codes in — open source, offline, and it supports a proper encrypted import/export of its own going forward.

The easier path: iOS + mitmproxy

Run mitmproxy on a Mac, log into Authy on an iPad through it, and read the encrypted token seed straight out of the proxied API request. Background reading:

Setting up mitmproxy with iOS 17.1 — configuring the Wi-Fi proxy and installing the mitmproxy cert so HTTPS traffic can actually be read.
Running Authy on Apple Silicon — a workaround for after Twilio blocked new iPad installs and killed the Mac desktop app, if you need Authy itself running on the Mac rather than just an iPad.
How to export your Authy tokens — the source for the decrypt.py script used below.

Steps

Start mitmproxy: mitmweb --allow-hosts "api.authy.com"
On the iPad, log into Authy so its traffic passes through the proxy.
In the mitmweb UI at http://127.0.0.1:8081/, find the request to https://api.authy.com/json/users/<user_id>/authenticator_tokens?otp3=<otp>&apps=&device_id=<device_id>&api_key=<api_key> and grab the response — it holds your encrypted token seeds.
Set up a Python virtualenv: python3 -m venv authy && source authy/bin/activate
Install the one dependency: pip3 install cryptography
Run python3 decrypt.py (from the freedomtechhq post above) and enter your Authy backup password when prompted. It writes out decrypted_tokens.json.

Viewing the tokens as QR codes

Once you have decrypted_tokens.json, this turns each secret back into a scannable QR code so you can re-enroll it in whatever authenticator app you're moving to:

Install ruby
gem install rqrcode
Save that script (call it authy_qr.rb) next to decrypted_tokens.json
ruby authy_qr.rb

Scan each resulting QR code into the new app one at a time, then confirm the generated codes match before deleting anything from Authy.