Importing maFiles from Steam Desktop Authenticator

Reviewed 26 September 2026 by MASTERPANEL LLC 3 min read Sources and testing: Version covered: ODA 1.5.1. Import behavior checked against the tagged implementation, its service tests, and SDA's published format Editorial method

Your accounts are yours. Import reads the same .maFile format SDA writes, shows you what it found, and stores nothing until you say so.

Before you start#

Do not delete your SDA installation. Keep it until you have confirmed the imported accounts generate the same codes. Importing copies; it does not move. There is no step here that alters your existing files. Turn off automatic confirmation while checking the new setup, so neither application approves items before you have reviewed them.

1. Find your maFiles#

They live in the maFiles folder inside your SDA installation directory, one .maFile per account, named after the SteamID — plus a manifest.json.

2. Select them#

Choose Import maFiles and select the account files. If your maFiles are encrypted you also need manifest.json: it holds the salt and initialisation vector, and without it an encrypted maFile cannot be decrypted at all. If you select an encrypted file and forget the manifest, the application looks for one beside the files you picked and adds it for you.

3. Unlock, if they are encrypted#

You will be asked for the passphrase you set in SDA — not your Steam password, and not the passphrase for this application's vault. It is used to decrypt the files in memory and is not stored.

4. Review what was found#

Nothing has been written yet at this point. The report lists each account it could read and flags anything that matters:

Accounts already in your vault, so you do not import a duplicate.
An identity_secret that is present but unusable — the account remains selectable with a warning. Login codes may still work when the shared_secret is usable, but confirmations will not.
A maFile with no revocation code. ODA cannot use its built-in deactivation option without that code; Steam may offer recovery through a linked phone number or Steam Support. Recovery routes.
A proxy setting found inside the file, which you can adopt or discard.
Files that could not be read at all, and why. A missing or empty identity_secret is rejected here rather than imported.

Tick the accounts you want and confirm the import. Read the result for each account: a warning or failed row is not a successful import. If you replace an existing entry, you replace that vault's stored copy; keep a backup first. Uncommitted staged files are discarded when you leave, lock the vault, or the ten-minute staging window expires.

5. Confirm the codes match#

Put the two applications side by side and check that an imported account shows the same five characters as SDA does. Same secret, same clock, same code. That checks the code-generating secret at that moment. It does not check the confirmation secret, recovery code or Steam session. Sign in when ODA requests it and check that confirmations load; review the recipient and items before approving anything. Keep an independent backup even after these checks pass.

Leaving again#

Use an account's Export button to save a standard .maFile. The file is unencrypted, even when the original import was encrypted. It contains authenticator secrets and any revocation code. Store it in a secure location and never upload it to a website or support report. ODA deliberately omits the Steam refresh token and proxy configuration: sign in again and configure routing in the destination app. Code compatibility does not guarantee that an unmaintained app's Steam login or confirmation features still work.