Open Desktop Authenticator

How to open a Steam .maFile

Reviewed by MASTERPANEL LLC 3 min read Sources and testing: File format checked against SDA's manifest implementation; ODA input requirements against its import service. The JSON example below is synthetic and cannot authenticate an account Editorial method

Choose whether you want to read its fields, decrypt an SDA backup, or use the authenticator in another app. A local text editor can display the file; it cannot decrypt encrypted contents just by opening them.

Choose your task
  • Read the fields: open a copied file in a trusted local text editor. Readable JSON needs no converter. The example below shows what to look for.
  • Decrypt an SDA file: keep the matching manifest.json and SDA encryption passphrase. Follow the encrypted-file guide; the Steam password is not a replacement for that passphrase.
  • Use the account in ODA: follow the import steps. Import reads authenticator data; it does not remove or replace the authenticator on Steam.

Keep real maFiles local. They contain authentication secrets or encrypted backups of them. Do not upload one to an online viewer, converter, AI chat or support form, including ours.

Make a working copy first#

  1. Find the SDA folder.

    Its maFiles folder normally sits beside the SDA executable, wherever you extracted it. It is not inside a fixed Steam folder. Search your own backups for *.maFile and manifest.json if needed.

  2. Close SDA and copy the entire maFiles folder.

    Use a private local folder, preserving the manifest beside the files. Do not overwrite your only backup. Avoid a location automatically shared or synced to another service.

  3. Open the copy with a local text editor.

    Choose Open with → Notepad or another editor you trust. Enable filename extensions: .maFile.exe is an executable, not a maFile. Inspect without saving changes.

Recognize readable JSON#

An unencrypted file has quoted names and values inside curly braces. Fields differ between exports. This synthetic example contains no usable credentials; it illustrates names only and is not an import-ready account:

{
  "account_name": "example_account_not_real",
  "shared_secret": "NOT_A_REAL_SECRET",
  "identity_secret": "NOT_A_REAL_SECRET",
  "revocation_code": "NOT_A_REAL_RECOVERY_CODE"
}

shared_secret generates login codes; identity_secret is used for confirmation signatures. A file may also contain a session or refresh token. See the field reference before treating an unfamiliar value as harmless. Missing revocation_code does not mean a viewer hid it; some files simply do not contain that optional field.

If you see encoded text instead#

A block of base64 text is consistent with SDA encryption, but its appearance alone does not establish that the file is valid. SDA's matching manifest supplies the encryption metadata; the correct passphrase is also needed. Keep these together and use a local compatible importer. Renaming the file or formatting it as JSON will not decrypt it.

An empty file, malformed JSON or an unexpected format may indicate the wrong file or a damaged copy. Preserve it, compare with another retained backup and follow the manifest/passphrase checks before editing anything. A missing passphrase or missing authenticator secret cannot be recovered from the filename.

Importing is a separate trust decision#

A text editor displays a copy. An authenticator uses its secrets to generate codes and, with a valid Steam session, act on confirmations. Before importing, identify the publisher and verify the download. For ODA, review the parsed accounts before committing the import, then check a fresh code and the confirmation session separately.

Opening or importing an old backup does not make an obsolete secret current again. If the authenticator was replaced on Steam, use a backup of the replacement or Steam's recovery routes. If you already shared a real file with an untrusted service, treat its secrets as exposed; changing a password alone does not rotate authenticator secrets.