Move your Steam authenticator from your phone to a PC
Steam supports moving an authenticator to a different device, and charges two days of trade restriction for it. The advice you will usually find — remove it from the phone, then add it somewhere else — is a different operation that costs fifteen. This page explains what the supported route actually does.
Steam does not copy the secret off your phone. It replaces the authenticator: you prove you hold the current one, Steam texts a code to the number on the account, and on submitting that code Steam issues a brand-new set of secrets to the new device and makes the phone's copy inert.
The cost is a 2-day trade and Market restriction, against 15 days for removing and re-adding.
Do not remove the authenticator from your phone first. That is the fifteen-day path, and it also leaves the account with no second factor in between. The transfer needs the phone's authenticator to still be working, because proving you hold it is the first step.
What Steam actually does#
This is worth understanding, because it explains why the phone stops working and why nothing needs uninstalling.
-
You prove you hold the current authenticator
By signing in with a code from it. Nothing has changed at this point.
-
Steam sends a code to the phone number on the account
Usually by SMS. It may arrive through a messaging app instead, from a sender name you do not recognise — that is normal for the services Steam sends through, and it is also exactly what a phishing message looks like, so never enter a code you did not just ask for.
-
You submit that code, and Steam rotates the authenticator
New secrets are issued to the new device. The ones on the phone stop being the account's authenticator at that moment. This step cannot be undone.
-
You write down the new recovery code
Steam issues a fresh one and the old one stops working. It is the only way to detach the new authenticator yourself later.
Because the replacement happens on Steam's side, there is nothing to uninstall. The phone's authenticator is already inert — removing it afterwards would be the fifteen-day operation, for no benefit.
What you need before starting#
- The authenticator still working on the phone. It is what proves the account is yours.
- Access to the phone number on the account. Steam texts a code to it and there is no way to finish without that code.
- Somewhere to write the new recovery code. Not on the machine you are moving to — that is the one it will not help you with.
- Not your old recovery code. It is void the moment the transfer completes.
What we observed doing this#
This project implemented the flow and ran it against a real account with an active authenticator, which is worth reporting because most of what is written about it is written by people who have not.
- Codes generated on the new device were accepted by Steam immediately.
- The account's authenticator was gone from the phone afterwards, and its Steam sessions had been signed out — the expected consequence of a server-side replacement, with nothing done to the device itself.
- The restriction applied was the short one, consistent with Valve's documented two days rather than the fifteen a removal carries.
One observation on one account is not a guarantee, and it is reported here as an observation rather than as documentation. Where Valve states something, this page quotes Valve instead — see the Steam Guard Mobile Authenticator page.
Can I use ODA for this?#
Not yet. Open Desktop Authenticator implements this flow, and it has been run successfully against a real account — but there is no public release yet, so there is nothing for you to download. The download page tracks exactly where that stands.
Whatever you use, the thing to check is which operation it performs. Software that removes the authenticator and adds a new one has cost you thirteen extra days whether or not it says so.