Importing maFiles from Steam Desktop Authenticator

In ODA, open Import maFiles → Choose files, select your SDA files, unlock them if encrypted, and review the accounts before importing. ODA reads the source files without moving or changing them. This copies an existing authenticator; it does not enroll a new one or transfer it off a phone.

Before you start#

1. Prepare the vault and find your maFiles#

Install the ODA package for your device, then create or unlock its vault. Keep the ODA vault passphrase separately from your backup. It may be different from the password you used to encrypt SDA files.

They live in the maFiles folder inside your SDA installation directory, one .maFile per account, named after the SteamID — plus a manifest.json.

• Readable files: select the account's .maFile.
• Encrypted SDA files: retain each .maFile, its matching manifest.json and the SDA encryption passphrase as a recovery set.
• No maFile, only a phone authenticator: this guide cannot export secrets from Steam Mobile. Read the phone-to-PC transfer guide.

2. Select them#

Choose Import maFiles on the accounts screen, then Choose files… and select the account files. If your maFiles are encrypted you also need manifest.json: it holds the salt and initialisation vector, and without it an encrypted maFile cannot be decrypted at all. If you select an encrypted file and forget the manifest, the application looks for one beside the files you picked and adds it for you.

3. Unlock, if they are encrypted#

You will be asked for the passphrase you set in SDA — not your Steam password, and not the passphrase for this application's vault. It is used to decrypt the files in memory and is not stored. Select Decrypt; readable accounts then appear under Found. If no files are encrypted, skip this step.

4. Review what was found#

Nothing has been written yet at this point. The report lists each account it could read and flags anything that matters:

• Accounts already in your vault, so you do not import a duplicate.
• An identity_secret that is present but unusable — the account remains selectable with a warning. Login codes may still work when the shared_secret is usable, but confirmations will not.
• A maFile with no revocation code. ODA cannot use its built-in deactivation option without that code; Steam may offer recovery through a linked phone number or Steam Support. Recovery routes.
• A proxy setting found inside the file. Its separate opt-in starts off; leave it off unless you recognise and still use that routing address.
• Files that could not be read at all, and why. A missing or empty identity_secret is rejected here rather than imported.

Check the account name and SteamID, tick only the rows you want, then select Import with the displayed account count. Existing vault accounts start unticked: choosing one permits replacing its stored copy. Back up the vault before doing that. If you opted into a proxy, a separate dialog identifies its address before import; decline it if you do not recognise the destination.

Read each Result row: imported and replaced mean the vault entry was written; skipped does not. An imported account can still have a recovery-backup warning that needs attention. Uncommitted staged files are discarded when you leave, lock the vault, or the ten-minute staging window expires.

5. Confirm the codes match#

Put ODA and a working copy of that account's authenticator side by side and compare the five-character codes within the same time window. If they differ, check the account and time synchronisation. Matching codes checks code generation at that moment, not all account functions.

Steam session and confirmations

Open Confirmations for that account and sign in when prompted. Refresh the list. A successfully loaded empty list is different from a sign-in or connection error; neither a matching code nor a file import proves a pending confirmation can be approved. Troubleshoot the session and review workflow. Do not create or approve a trade merely to finish this guide.

Recovery and backups

Keep the original backup and confirm you can read the saved recovery information. Record the recovery code outside the vault where available. Do not deactivate Steam Guard to test a code; review the recovery-code guidance.

If an import does not complete#

Leaving again#

Use an account's Export button to save a standard .maFile. The file is unencrypted, even when the original import was encrypted. It contains authenticator secrets and any revocation code. Store it in a secure location and never upload it to a website or support report. ODA deliberately omits the Steam refresh token and proxy configuration: sign in again and configure routing in the destination app. Code compatibility does not guarantee that an unmaintained app's Steam login or confirmation features still work.

Related#

• What is actually inside a maFile
• Encrypted maFiles: the password and the manifest
• How they are stored once imported
• Full documentation