tofa import

Import accounts from any file format other authenticators (and TOFA itself) emit. One unified dispatcher handles every shape: single- and multi-QR images, Google Authenticator migration QRs, JSON / CSV / TXT exports from the major mobile and desktop authenticators, and zip archives mixing any of the above.

Synopsis

tofa import

Supported formats

The dispatch is by extension, then by content where the extension is ambiguous. A .txt file containing a single otpauth-migration:// URI is expanded into every account it carries.

Examples

Aegis or andOTP JSON export:

$ tofa import ~/Downloads/aegis-export.json
Passphrase: ********
Imported 12 account(s).

A printout (or screenshot) showing many QRs at once:

$ tofa import ~/Downloads/backup-printout.png
Passphrase: ********
Imported 11 account(s).

A Google Authenticator export QR:

$ tofa import ~/Downloads/migration.png
Passphrase: ********
Imported 8 account(s).

A zip from tofa-app's Save All button — round-trips your backup without manually unzipping:

$ tofa import ~/Downloads/tofa-qrs.zip
Passphrase: ********
Imported 12 account(s).

A plain-text list of otpauth:// URIs (Ente Auth's export format, or the output of tofa export --format uris):

$ tofa import ~/Downloads/tofa-export-2026-05-07.txt
Passphrase: ********
Imported 5 account(s).

Notes

• Skips entries that already exist in the vault (matched on name + secret). Re-importing the same file is safe and reports the skip count.
• Zip extraction is in-memory: bytes are never written to disk during import, so slip-path attacks aren't a concern.
• The source file is plain text — delete it after import (shred -u on Linux, rm -P on macOS).

See also

• tofa export — produces JSON or a .txt URI list, both of which import reads back.
• tofa scan — capture screens directly without saving QRs to disk first.
• Recipe: import from Aegis / andOTP — step-by-step migration.