How to open a Steam `.maFile` safely

There is no special program needed to look inside one. A maFile is a small text file, and a text editor will show you everything in it. The care required is not technical — it is about what you do with the file afterwards.

Never use an online file viewer or converter on a real maFile. Search results for this file extension are full of "open any file online" sites that ask you to upload it. Uploading a maFile hands over the authenticator itself. There is no legitimate reason for a website to see one.

1. Find it

SDA is a portable program, so its maFiles folder sits beside the SDA executable — wherever you unzipped it — not inside your Steam installation and not in Program Files. If you are hunting for it, search your drive for the maFiles folder rather than for the file itself.

Unrelated file, same-looking extension: Autodesk Maya uses .ma. If a file opens as 3D scene data, you have the wrong one.

2. Work on a copy

Copy the file somewhere else and work on the copy. A maFile is frequently the only surviving record of an authenticator, and a text editor that helpfully saves a change can corrupt the JSON. Never edit the original.

3. Open the copy in a plain text editor

Notepad on Windows, or any code editor. Do not double-click the file and let Windows pick something; choose the editor deliberately with Open with. What you should see is JSON — curly braces and quoted field names.

4. Work out which kind you have

Readable field names: shared_secret, identity_secret, account_name and friends. This is an unencrypted maFile, and everything in it is live. Here is what each field does.
One long unbroken block of base64: Encrypted. You will need the passphrase and the manifest.json that was beside it — this is the page for that.
Neither, or the file will not open: Check you are looking at the right file. maFiles are usually a few kilobytes; something much larger is probably not one.

Reading it is safe. Uploading it is not. Do not paste the contents into a website, a Discord bot, a pastebin, an AI chat, or a support form — including ours. Anyone who receives that text can generate your Steam Guard codes from then until the authenticator is detached from the account entirely — the shared secret never expires. If the file also carries usable session tokens they may be able to approve trades immediately; if not, they need to sign in first, and holding your codes is a long way towards being able to.

5. The decision that actually matters

"Opening" a maFile in an authenticator is a much larger act than reading it. You are handing a program the authority to act as your account — permanently, because these secrets never expire. To Steam the requests it signs carry the same cryptography yours would.

So the question is not whether the software can read the format. It is whether you are willing to give the people who wrote it that authority. Before loading a maFile into anything, including ODA, check that you can name who publishes it, verify the download is what they published, and read what it does with the secret afterwards. Counterfeit authenticators exist specifically to be handed maFiles, and they look like the real thing.