For passwords, our default is Bitwarden. Its free plan has no limit on passwords or devices, it’s open source and audited, and it reads Google’s password export as-is.
Your password manager and authenticator hold the keys to every other account, so people put this move off for fear of being locked out. The answer is the order. Done in the sequence below, you always have a working way to sign in, and Google’s copy stays in place until you’ve proved the new setup works.
There’s a second reason to move these two early. Google Authenticator can sync your codes to your Google account, and Google Password Manager lives there too. If you plan to delete that account, or ever lose access to it, your logins shouldn’t depend on it.
Quick Comparison
Authenticator Apps
| App | Best for | Price (Oct 2026) | Backup and sync | Platforms | Open source |
|---|---|---|---|---|---|
| Ente Auth | Most people, on every device | Free | Optional end-to-end encrypted sync | iOS, Android, web, Windows, macOS, Linux | Yes (AGPL) |
| Proton Authenticator | Proton users; a European option | Free, no ads | End-to-end encrypted sync with a Proton account; works offline without one | iPhone, iPad, Apple Watch, Mac, Android, Windows, Linux | Yes |
| Aegis | Android users who want no cloud | Free | Encrypted local and automatic backups | Android only | Yes |
| 2FAS | A simple iPhone app without an account | Free (donations) | Optional cloud backup, or manual | iOS, Android, Apple Watch, browser extension | Source published |
Password Managers
| App | Best for | Free plan | Paid (Oct 2026) | Where your vault lives | Open source |
|---|---|---|---|---|---|
| Bitwarden | Most people | Unlimited passwords and devices | Premium about $19.80/year; Families (6 users) about $47.88/year | End-to-end encrypted cloud, or your own server | Yes |
| Proton Pass | Proton Mail users who want email aliases | Unlimited devices, 2 vaults, 10 aliases | Pass Plus about $35.88/year; Pass Family (6 users) about $59.88/year | End-to-end encrypted cloud, Switzerland | Yes |
| KeePassXC | People who want no cloud at all | Free | None | An encrypted file you store and sync yourself | Yes |
The Alternatives, One by One
Ente Auth
Ente Auth is a free, open-source authenticator with optional end-to-end encrypted sync, so a lost phone doesn’t mean lost codes. It runs on Windows, macOS, Linux and the web as well as on phones, which helps if you sign in from a computer most of the day.
The main deal-breaker is that you need an Ente account to sync. Before you start, open its import screen and check that Google Authenticator is listed.
Proton Authenticator
Proton released its authenticator in July 2025. It’s free, has no ads, is open source, and works offline without an account. Sign in with a Proton account and your codes sync with end-to-end encryption. It imports from Google Authenticator as well as 2FAS, Aegis, Bitwarden Authenticator, Ente Auth and LastPass, and it can export too, so you aren’t stuck with it.
Choose it if you already use Proton Mail or Proton Pass, or you want a European company.
Aegis
Aegis is the long-standing favorite on Android. Codes stay on your phone in an encrypted vault, with encrypted automatic backups you can copy elsewhere. It imports from a wide range of 2FA apps. Get it from F-Droid or Google Play.
The deal-breaker is that there is no iPhone version. If you might switch to iPhone later, pick Ente Auth or Proton Authenticator.
2FAS
2FAS is a free, donation-funded app that works without an account, with an optional cloud backup. It also has an Apple Watch app and a browser extension.
A possible deal-breaker is how it exports, so check that before you commit and make sure you can leave it later as easily as you leave Google.
Bitwarden
Bitwarden has the best free plan of any password manager, with unlimited passwords on unlimited devices. It’s end-to-end encrypted, open source and independently audited. It supports passkeys, and you can run your own server if you want full control.
Premium’s price went up to about $19.80/year (Oct 2026), from the $10/year it cost for years. Premium adds 2FA codes inside the vault, 5 GB of attachments, emergency access and health reports. Families covers 6 users for about $47.88/year. Check the current price at checkout.
The deal-breakers are that the apps look plainer than paid rivals and 2FA codes need Premium.
Proton Pass
Proton Pass is polished, Swiss and tied in with Proton Mail. Its standout feature is hide-my-email aliases, which give each site its own address. The free plan covers unlimited devices, 2 vaults and 10 aliases, but has no built-in 2FA codes. Pass Plus costs about $2.99/month billed $35.88/year (Oct 2026).
KeePassXC
KeePassXC keeps your passwords in one encrypted file on your own computer, with no company cloud involved. It supports passkeys and 2FA codes. It runs on Windows, macOS and Linux; on phones you need a separate KeePass-compatible app.
The deal-breaker is that sync and backups are your job, for example with Syncthing, Nextcloud or Proton Drive.
How to Switch Without Getting Locked Out
The order matters more than the apps, so follow this sequence.
- Move your passwords.
- Make the new manager your default.
- Move your 2FA codes.
- Re-enroll the accounts that didn’t move.
- Save backup codes offline.
- Test recovery.
- Only then remove your data from Google.
Move Your Passwords First
Export from Google on a computer if you can. The steps below use Chrome on desktop.
- In Chrome, open the More menu (three dots), then Passwords and autofill, then Google Password Manager. The direct address is
chrome://password-manager/settings. - Click Settings in the left menu, then Export passwords, then Download file.
- Enter your computer password when asked. Chrome saves a CSV file.
On Android, open Chrome’s More menu, then Settings → Autofill and passwords → Google Password Manager, tap the gear, then Export passwords & passkeys and Download file. Android can also hand your passwords straight to another manager. Start the import in the new app, then tap Export in Google Password Manager. On iPhone, go to Chrome’s Settings → Autofill and passwords → Password Manager → Settings → Export data.
Now import the file in Bitwarden’s web vault.
- Go to Tools → Import, choose the vault My vault and the file format Chrome (csv).
- Choose the CSV file and click Import. In the browser extension, the same option sits under Settings → Vault options → Import items.
- Check that your logins arrived. Import only once, because Bitwarden doesn’t remove duplicates.
Proton Pass and KeePassXC import the same Chrome CSV through their own import menus.
Before you delete the file, you can use it to see every account tied to your Gmail address. Our scan reads it in your browser, ignores the password column and uploads nothing.
- Delete the CSV and empty the trash. Google warns that anyone who uses the device can open the file and read your passwords.
Make the New Manager Your Default
- On Android, go to Settings → Passwords & accounts → Autofill service, then pick Bitwarden (or your choice).
- On iPhone, go to Settings → General → AutoFill & Passwords, then turn on Bitwarden.
- In Chrome and on Android, turn off Offer to save passwords and Auto sign-in in Google Password Manager, so new logins don’t keep landing at Google.
Leave Google’s copy in place for now. It’s your safety net until step 7.
Then Move Your 2FA Codes
Google Authenticator can export all your codes at once as QR codes. This is easiest with two devices, so the old phone can show the codes while the new app scans them.
- Install your new authenticator and open its import option for Google Authenticator.
- In Google Authenticator, open the menu and choose Transfer codes, then Export codes. Older versions of the app say Transfer accounts and Export accounts.
- Select all your accounts and tap Next. The app shows one or more QR codes.
- Scan every QR code with the new app. Long lists are split across several codes, so scan them all.
- Test each account. Compare the codes side by side, or sign out of one site at a time and sign back in with the new code.
Only one phone? Some apps can import a screenshot of the QR code. Delete the screenshot right away, because anyone who sees it can copy your codes.
On Android, our Google Authenticator to Aegis walkthrough covers this move screen by screen, including what to do when the app blocks screenshots.
Then turn on the new app’s encrypted backup or sync, and also save an encrypted backup file somewhere offline, such as a USB stick.
Re-Enroll the Accounts That Didn’t Move
Some logins don’t use standard codes and won’t transfer. Steam, Microsoft’s push approvals and banking apps need to be set up again inside each service. Do the same for any account you can’t find in the export.
For each one, sign in, open the account’s security settings, set up an authenticator app again, scan the new QR code with your new app, and enter the code it shows to confirm.
Save Backup Codes Offline
Most services offer one-time backup or recovery codes when you turn on 2FA. For every account you’d hate to lose (email, bank, password manager, phone account), save them now.
- Print them or write them down, and keep the paper somewhere safe at home.
- Store them away from your authenticator. A good rule is that you should be able to lose your password or your 2FA device, but never both at once.
- Write your password manager’s master password and recovery details on the same sheet. This is your emergency kit.
Test Recovery
Prove you can get back in without your current phone. Do this on a spare device, or after reinstalling the apps.
- Sign in to your password manager with only your master password and its second factor.
- Restore your authenticator from its backup or sync.
- Sign in to two or three important accounts, including your email.
If anything fails, fix it now, while Google’s copies still exist.
Only Then Remove Your Data From Google
- Delete your passwords after about two weeks without problems. Open Google Password Manager, go to Settings and choose Delete all Google Password Manager data.
- For authenticator codes, if you synced them to your Google account, turn off cloud sync by choosing Use without an account under the profile icon in Google Authenticator. Then delete the entries and the app.
- Check your Google account’s own 2-Step Verification if you’re keeping the account for now, and make sure its sign-in doesn’t depend on the app you just deleted.
When you’re ready to close the account itself, follow our delete your Google account guide. Switch any Sign in with Google logins to a password first.