What is a .maFile?
A readable maFile is a small JSON file holding one Steam account's authenticator
secrets and metadata; SDA can also store it as encrypted ciphertext. Anyone with the
shared_secret from it can generate that account's Steam Guard
codes; with the identity_secret and a valid Steam
session they can also
approve confirmations. A
maFile can carry session material too, which is why losing one is treated here
as a credential exposure that needs prompt investigation.
What is inside one#
shared_secret- The seed the login codes are generated from, stored as base64 text. Combined with the current thirty-second time window it produces the five characters you type into Steam. It does not expire with time: it stays valid until the authenticator is removed or replaced, which is the only thing that stops a copy of it working.
identity_secret- The seed used to sign trade and market confirmations. This is the dangerous one: together with a valid Steam session it is what lets software approve a trade on your behalf. It cannot raise or approve one on its own.
revocation_code-
Short, in the form
R12345. One of the ways to detach the authenticator yourself — the one that still works when the device is gone and no phone number is linked. Valve also documents removing it from inside the Steam Mobile App and transferring it to a new device with an SMS code if you no longer have the old one. Printed backup codes are emergency sign-in codes, not replacement revocation codes. Losing it is a different kind of problem. Session- Login tokens for the account. These do expire, which is why an old maFile often still generates valid codes but cannot fetch confirmations until you sign in again.
account_name,steamid,device_id-
Identifying fields. The SteamID is a 64-bit number — large enough that
software handling it as a JavaScript
Numbercan round the last digits. Keep SteamIDs as strings or losslessly parsed integers.
Encrypted maFiles#
SDA can encrypt them. Its
encryption implementation
and manifest code
show that the file's contents are base64 ciphertext
and the parameters needed to decrypt — the salt and the initialisation vector —
are stored separately in manifest.json, keyed by SteamID.
The practical consequences catch people out regularly:
-
Copying only the
.maFileto a new machine leaves you with something you cannot open. You need the manifest too. - An encrypted maFile, its matching manifest and the correct passphrase can make a usable backup. Without the passphrase there is no supported decryption shortcut; recovering account access through Steam is a separate process.
- Encryption protects the file at rest on your disk. It does not protect it from a program you willingly type the passphrase into.
How to handle one#
- Treat it as an account credential. A password change alone does not rotate a leaked shared secret. Replace the compromised authenticator through Steam and revoke other exposed credentials too.
- Do not send a readable maFile to a website, bot or support ticket. ODA support does not need it. Anyone you give it to gains access to those credentials. Encrypt backups before placing them on storage outside your control.
- Keep the revocation code somewhere the file is not. A backup that loses both at once has not backed anything up.
- Be careful which program opens it. Counterfeit authenticators exist specifically to be handed maFiles.