What is a .maFile?
A maFile is a small JSON file holding one Steam account's authenticator. Not a copy of it, not a reference to it — the authenticator itself. Anyone with the file can generate that account's Steam Guard codes and approve its trades.
What is inside one
shared_secret- The seed the login codes are generated from. Base64, twenty bytes decoded. Combined with the current thirty-second time window it produces the five characters you type into Steam. It never expires and never changes.
identity_secret- The seed used to sign trade and market confirmations. This is the dangerous one: it is what lets software approve a trade on your behalf.
revocation_code-
Short, in the form
R12345. The only way to detach the authenticator yourself. Losing it is a different kind of problem. Session- Login tokens for the account. These do expire, which is why an old maFile often still generates valid codes but cannot fetch confirmations until you sign in again.
account_name,steamid,device_id- Identifying fields. The SteamID is a 64-bit number — large enough that software handling it as a floating-point number silently corrupts the last digits, which is a real and common bug.
Encrypted maFiles
SDA can encrypt them. When it does, the file's contents are base64 ciphertext
and the parameters needed to decrypt — the salt and the initialisation vector —
are stored separately in manifest.json, keyed by SteamID.
The practical consequences catch people out regularly:
-
Copying only the
.maFileto a new machine leaves you with something you cannot open. You need the manifest too. - An encrypted maFile is not a backup of a readable maFile. If you lose the passphrase, the contents are gone the same way any AES ciphertext is gone.
- Encryption protects the file at rest on your disk. It does not protect it from a program you willingly type the passphrase into.
How to handle one
- Treat it as more valuable than the account password. A password can be changed in a minute. A leaked shared secret keeps working until the authenticator is detached from Steam entirely.
- Never upload one anywhere. Not to a support ticket, not to a "maFile checker", not to a Discord bot, not to us. No legitimate service needs it.
- Keep the revocation code somewhere the file is not. A backup that loses both at once has not backed anything up.
- Be careful which program opens it. Counterfeit authenticators exist specifically to be handed maFiles.