On this page
Plan an Aegis Authenticator recovery copy #
For the worked example, use a vault containing two noncritical demonstration entries labeled Studio demo and Backup practice. The labels illustrate what to check after restoration; they aren't accounts or codes provided by this article. Keep the original working vault while reviewing the recovery copy.
Aegis's official FAQ explains that manual exports and automatic backups use the same vault-file format. Its official application resources document the Import & Export and Backups controls used below.
1. Open the vault and its export settings #
Open your Aegis vault, open the three-dot menu, and select Settings. Open Import & Export, then select Export, whose description is Export the vault.
The export dialog offers formats including Aegis (.JSON). Choose that format for an Aegis recovery copy. Other export formats serve other purposes and may not preserve the same information or encryption arrangement.
Before proceeding, know the vault password. Biometric unlocking can make it easy to forget a password that restoration still requires. Don't assume the replacement phone's fingerprint enrollment can decrypt an exported file by itself.
2. Keep the export encrypted #
Leave Encrypt the vault enabled. Aegis warns when an export would be unencrypted. For this backup workflow, use the encrypted vault format and continue with its encrypted export.
By default, the export uses the vault password. Aegis also documents Separate password for backup & export in its security settings. If that is configured, the recovery file needs that separate password instead.
Record which password applies in your controlled recovery records, without putting it alongside a publicly accessible copy. The file and its password are two separate parts of the recovery path.
3. Save the file in a recoverable location #
Use Android's file picker to choose a controlled destination. Give the copy a recognizable dated name if the picker lets you rename it, then finish saving.
For the sample, organize it under a recovery folder with a name such as aegis-demo-2026-10-08.json. The filename doesn't protect the contents; encryption does. Choose a location you can access if the phone is gone, not only a folder on that phone.
Check that the saved file is present and has a nonzero size. That confirms a file exists, while the next step checks whether it can be read. Don't treat the file's presence alone as a completed restore check.
4. Import the copy into the recovery destination #
On the intended Android recovery device, use Aegis's setup option Import Aegis vault, or after setup open Settings → Import & Export → Import from file.
Select the encrypted JSON file. When Aegis asks Please enter the import password, enter the password used for that export. Read any import options before completing the operation, especially if the destination already contains accounts.
Use a clean demonstration destination for this walkthrough so existing accounts aren't mixed into the sample. The intended result is the two demo entries appearing with their recognizable labels.
5. Verify the entries and the recovery access #
Compare the restored labels with the source: Studio demo and Backup practice. For real account recovery, also verify the intended accounts through their normal sign-in process while the old device and the websites' recovery codes remain available.
A time-based code can differ near the moment it rolls over, so compare the account and timing carefully. If codes fail, check the device clock and that you selected the right account before editing secrets or re-enrolling verification.
The outcome you want is a file you can locate, a password that unlocks it, and the intended entries available on the recovery device. Keep those checks together in the recovery record.
6. Configure automatic backups for future changes #
In Settings, open Backups and enable Automatically back up the vault. Review Backup location, Backup strategy, and Number of versions to keep. The documented Trigger backup control lets you request a copy using the configured route.
The FAQ's automatic-backup section explains that a cloud provider must fully support Android's Storage Access Framework. Nextcloud is documented as working; a local folder synchronized separately is another route.
Make sure the automatic destination is also reachable after phone loss. If backups stay only on the phone, they help with some app problems but don't solve losing that device. Recheck the route after changing storage providers or Android permissions.
Known problems and fixes #
The import password is rejected
The application's documented strings include a separate backup/export password option. Check whether the file used that password or the vault password. A newly changed vault password doesn't automatically explain the password of every older exported copy.
A cloud provider doesn't receive automatic backups
The official FAQ identifies incomplete Android storage-provider support. Choose a supported provider or a local folder with a separately maintained sync route. Check that a triggered backup reaches the actual destination before relying on it.
An export from another app fails to import
A January 2026 import report described an unsupported export producing a password error. Choose the importer for the actual source format; for this walkthrough, use the encrypted Aegis JSON copy. The source application's own export instructions decide which compatible file to create.
The restore route is hard to find
A documentation request asks for clearer Android-storage restore instructions. The saved vault uses the same import route as an export: Import from file in Import & Export. Select the stored file through Android's picker and use its import password.
Troubleshooting #
| Problem | Likely cause | Fix |
|---|---|---|
| Password fails | Different export password or older copy | Identify the password used for that file |
| File isn't visible | Wrong folder/provider or access | Open the intended destination in Android's picker |
| Automatic cloud copy is absent | Provider doesn't fully support storage access | Use a supported provider or separately synced local folder |
| Restored labels are duplicated | Import mixed with an existing vault | Review entries and import options; use a clean demo destination |
| Codes fail after restore | Clock mismatch or wrong account | Check device time and account identity |
| Copy is lost with the phone | Backup existed only locally | Maintain a controlled off-device copy |
Variations #
Move to a replacement Android phone
Use the same encrypted-file route and verify the real accounts before erasing the old device. Retain each website's recovery codes as a separate way back in if app restoration is interrupted.
Move to another authenticator
Read the destination app's supported import formats first. An encrypted Aegis recovery file is designed for Aegis restoration; another app may require a different export. Plan that migration while the working vault remains available.
Keep several dated versions
Use the backup version setting and a controlled storage routine. Several versions can help after an accidental account change, but confirm how much storage is used and which file matches the password recorded for it.
Completion checklist #
- The recovery file is an encrypted Aegis JSON export.
- Its applicable password is recorded through a separate controlled route.
- The file is reachable away from the main phone.
- The intended entries appear after import.
- Real account access is verified before erasing a working device.
- Automatic backups, if enabled, reach the intended location.
Next steps #
Read Aegis vs Ente Auth and the free authenticator shortlist when choosing a long-term access model. See Aegis, Aegis alternatives, and Proton Authenticator for other device arrangements.
