To get a secret key for Google Authenticator, look for the text string displayed by the service during the initial two-factor authentication setup, often labeled "setup key" or "manual entry key." This key appears alongside the QR code and is what you need to manually enter when a scan fails or is unavailable.
Where to find your secret key for Google Authenticator during setup
The secret key is provided by the online service at the exact moment you enable two-factor authentication. During enrollment, most services show both a scannable QR code and a plain-text string beneath or beside it. This is the only time the service displays the key in plain text, so copy it immediately. You will need this key if you want to integrate Google Authenticator without scanning the QR code, or if you plan to save the key for later recovery.
How to enter the secret key into Google Authenticator
Once you have the secret key, entering it into the app takes a few seconds. Follow these steps:
- Open the Google Authenticator app on your device.
- Tap the "+" icon to add a new account.
- Paste or type the secret key into the provided field. The key is case-insensitive and typically includes only letters and numbers.
- Tap "Add" to complete the process. The app will immediately begin generating time-based codes for that account.
- Verify the setup by entering the current code shown in the app into the service's verification field.
What to do if you didn't save the secret key
If you did not save the secret key during setup, you cannot extract it from the Google Authenticator app itself. The app stores keys in an encrypted format and does not offer a way to view them. To obtain a new key, you must disable two-factor authentication on the affected service, then re-enable it. During the re-enable process, the service will present a new QR code and a new secret key. Save this key immediately in a secure location, and learn how a setup key in Google authenticator lets you manually restore access if your phone is lost.
How to use your saved secret key for account recovery
When migrating to a new phone or restoring accounts after a device reset, your saved secret key is the only way to regain access without disabling 2FA. On the new device, open Google Authenticator, tap "+", select "Enter a setup key," and paste the saved key. The app will restore the account and begin generating valid codes. Storing these keys securely, such as in a password manager or an encrypted offline file, ensures you can recover access even if your phone is lost or replaced. Without the saved key, you would need to disable and re-enable 2FA on each service individually.
Secret key vs backup codes: what's the difference
The secret key is used for initial setup and account recovery, allowing you to add an account to Google Authenticator at any time. Backup codes, on the other hand, are one-time-use codes provided by the service for logging in when you cannot access the app. They are not used for setup or migration. For a full breakdown of when to use each, see the article on backup codes vs secret keys.
