Steam 令牌换手机：怎么迁移验证器才不挂 15 天交易冷却
换了新手机。最容易想到的做法——找 Steam 客服移除令牌，再在新手机上重新绑定——代价是十五天不能交易、 不能上架市场。其实大多数情况下不用这么干：你可以迁移令牌而不是移除它， 而迁移完全不挂冷却。
先说结论
- 能收到这个账户的邮件？直接迁移。Steam 发一封带验证码的邮件，输进去就完成，不挂冷却。旧手机不需要在手边。
- 手里有
.maFile（SDA、AVA，或 Steam++ / Watt Toolkit 导出的）？把文件导进新设备就行，全程不惊动 Steam。 - 设备和撤销码都丢了？那只能走客服，十五天跑不掉。
这个冷却期到底是干嘛的
如果有人偷到了你的密码，挡在他和你库存之间的就只剩令牌。所以攻击者第一件事一定是把令牌弄掉。 Valve 的对策是让「弄掉」这个动作变贵：令牌一旦从账户上摘除，交易和社区市场立刻冻结十五天。
这不是在罚你换手机，而是因为 Steam 根本分不清你的新手机和小偷的手机。而这恰好指向大多数人忽略的那一点：
移除令牌等于把这层保护打断了，所以要赔十五天；迁移不会—— 保护从头到尾没有中断过，自然没有什么需要「等」的。这是两个不同的操作，整件事的关键就是选对第二个。
三条路
| 路线 | 交易冷却 | 需要什么 |
|---|---|---|
| 把令牌迁到新设备 | 无 | 能打开这个账户的邮箱 |
导入已有的 .maFile | 无 | 那个文件，别的都不用 |
| 找客服移除令牌 | 15 天 | 什么都不需要——这是最后手段 |
路线 A——把令牌迁过来
这和官方 Steam App 在新手机上登录时做的是同一个操作。AVA 也能做，因为走的是 Steam 的同一个接口。
- 在新设备上装好 AVA，登录这个 Steam 账户。
- 账户已经有令牌了，于是会出现「把令牌迁移到本设备」。
- Steam 往账户绑定的邮箱发一个验证码，输进去。
- 确认。令牌现在在这台设备上了。
注意这份清单里没有旧手机——它不是必需品。真正必需的是能读到账户绑定邮箱里的信。 如果这个账户是好些年前注册的，那个邮箱地址很可能是你早就不看的那个，动手前先确认一下。
按下确认的那一刻会发生什么
- 旧设备上的令牌立刻失效。不是今晚、不是明天，就是你点确认的那一秒。
- 你的撤销码（
Rxxxxx那串）会换成一个新的，旧的作废。新的只显示一次——离开那个界面之前抄下来。 - 以上都不可撤销。
撤销码是大家最爱跳过的一步，也恰恰是一年后手机躺在湖底时唯一还管用的东西。它是不惊动客服就能把令牌 从账户上摘下来的唯一办法。抄在手机以外的地方。
路线 B——你已经有 maFile 了
只要你用过 Steam Desktop Authenticator、Steam++ / Watt Toolkit，或者 AVA 本身，你的令牌就已经以 文件形式存在了——就是那个 .maFile。迁移它等同于拷贝一个文件：
- 在旧设备上导出或找到
.maFile。 - 在新设备上导入。
全程不联系 Steam。没有东西被移动、没有东西被撤销、不发邮件、不挂冷却——因为在 Steam 看来什么都没发生， 你只是让这份密钥多了一个副本。同一个账户能同时活在 AVA 和 ArchiSteamFarm 里，也是这个道理： 两边读的是同一个文件。
.maFile 是明文的。里面装着这个账户的 Steam Guard 密钥和撤销码—— 谁拿到这个文件，谁就能接管你的令牌。请完全按密码对待：不发在聊天里、不放共享盘、 更不要上传到任何声称能帮你「验证」它的网站。
任何正规的交易机器人、饰品平台、客服，都永远不会向你索要这个文件。 开口要的，无一例外是在偷你的账户。
反过来说：趁一切正常的时候先导出一份。十秒钟的事，能把以后每一次换手机都变成路线 B。
路线 C——移除后重新绑定
只有设备和撤销码都没了才走这条。Steam 里：客服 → 帮助 → Steam 令牌。做好等十五天的准备。
而且这条路会让你赔两次时间：Valve 还要求新绑定的令牌满七天，才能交易或使用社区市场。 这个等待期只针对全新绑定的令牌，迁移过来的不算——这也是为什么值得花点力气去把那个邮箱密码找回来。
真正让人丢账户的几个动作
- 把撤销码截图。然后它同步进了云相册，账户的最后一道防线从此存在某个云服务里。
- 把 maFile 发给别人。见上。没有任何场景下这是对的做法。
- 以为迁移之后旧手机还在守着账户。它没有。清空它之前心里要有数。
- 等到手机坏了才动手。趁两台设备都在手上、都能开机的时候把迁移做掉。任何一台一旦没了，上面每条路都会变难。
常被问到的
旧手机必须在吗？
不必。需要的是账户邮箱。旧手机在手边更方便，但不是必需。
邮件收不到。
先翻垃圾箱。然后确认账户上绑的是哪个邮箱——Steam 发到的是账户里登记的地址， 经常不是你现在用的这个。如果确实读不到，那就只剩路线 C 了。
我有好几个账户：主号、小号、还有几个挂机的。
一台手机只能装一个官方 Steam 令牌，这正是为什么大家最后手里会攒着一堆 maFile 和一个要走到电脑前 才能用的桌面工具。AVA 把它们放在同一个列表里，手机和桌面都行，每个账户各自的验证码、交易确认、 报价都在。
这算违规吗？
迁移走的是官方 App 用的同一个接口，本来就是官方支持的迁移方式。AVA 本身是非官方的社区项目， 与 Valve 和 Steam 没有任何隶属关系。它以 MIT 协议开源——不想凭空信任的话，代码就在那里， 这也正是它开源的意义。
要花钱吗？
不要。验证码、交易确认、登录批准、令牌迁移、.maFile 导入导出，在所有版本里都免费， 以后也一样。付费档解锁两套皮肤并去掉广告。你也可以自己编译一个完全不含广告与计费代码的版本。
去哪拿 AVA
Android 版在 Google Play。 Windows、Linux、macOS 版本和直发 APK 在下载页。 源码在 GitHub。
Move your Steam Guard authenticator to a new phone — without the 15-day trade hold
You got a new phone. The obvious route — ask Steam Support to remove the authenticator, then set it up again — costs you fifteen days of not being able to trade or sell anything. It does not have to. In most cases you can move the authenticator instead of removing it, and a move carries no hold at all.
The short version
- You can read the account's email? Transfer the authenticator. Steam emails a code, you enter it, done. No trade hold. You do not need the old phone.
- You already keep a
.maFile(from SDA, AVA, or Steam++ / Watt Toolkit)? Just import the file on the new device. Steam is not involved at all. - Lost the device and the revocation code? Then it is Steam Support, and yes — fifteen days.
Why the hold exists in the first place
If somebody steals your password, the authenticator is the thing standing between them and your inventory. So the very first move an attacker makes is to get rid of it. Valve's answer is to make removal expensive: once an authenticator comes off an account, trading and Community Market access are frozen for fifteen days.
That is not a penalty for changing phones. It is there because Steam has no way to tell your new phone apart from a thief's. Which points straight at the thing most people miss:
Removing an authenticator breaks the protection, so it costs fifteen days.Moving one does not — coverage never lapses, so there is nothing to wait out. They are different operations, and the whole game is picking the second one.
The three routes
| Route | Trade hold | What you need |
|---|---|---|
| Transfer to the new device | None | Access to the account's email inbox |
Import an existing .maFile | None | The file, and nothing else |
| Remove via Steam Support | 15 days | Nothing — this is the last resort |
Route A — transfer the authenticator
This is the same operation the official Steam app performs when you install it on a new phone and sign in. AVA does it too, because it is the same Steam endpoint.
- Install AVA on the new device and sign in to the Steam account.
- The account already has an authenticator, so you will be offered “Move the authenticator to this device.”
- Steam emails a code to the address on the account. Enter it.
- Confirm. The authenticator is now here.
Note what is not on that list: the old phone. You do not need it. What you do need is to be able to read the email on the account — which, for an account you set up years ago, may be an address you have not opened in a while. Check that before you start.
What changes the moment you confirm
- The authenticator on the old device stops working immediately. Not tonight, not tomorrow — the moment you tap confirm.
- Your revocation code (the
Rxxxxxone) is replaced by a new one. The old code is dead. The new one is shown once — write it down before you leave the screen. - None of this can be undone.
The revocation code is the part people skip, and it is the part that matters in a year when the phone is at the bottom of a lake. It is the only way to take an authenticator off an account without going through Steam Support. Put it somewhere that is not the phone.
Route B — you already have a maFile
If you have ever used Steam Desktop Authenticator, Steam++ / Watt Toolkit, or AVA itself, then your authenticator already exists as a file — a .maFile. Moving it is a file copy:
- Export or locate the
.maFileon the old machine. - Import it on the new one.
Steam is never contacted. Nothing moves, nothing is revoked, no email is sent, and there is no hold — because from Steam's point of view nothing happened. You simply have the secret in a second place. This is also why the same account can be live in AVA and in ArchiSteamFarm at once: they read the same file.
A .maFile is not encrypted. It contains the account's Steam Guard secret and its revocation code — whoever holds the file can take the authenticator over. Treat it exactly like a password: never in a chat, never in a shared drive, never uploaded to a site that offers to “verify” it.
No legitimate trading bot, marketplace, or support agent will ever ask you for one. Every single party that does is stealing your account.
The corollary: export a maFile while things are fine. It takes ten seconds and it converts every future phone change into Route B.
Route C — remove and re-add
Only when both the device and the revocation code are gone. In Steam: Support → Help → Steam Guard Mobile Authenticator. Budget fifteen days.
And be aware it costs you time twice: Valve also requires a newly added authenticator to have been active for seven days before you can trade or use the Community Market. That waiting period applies to a fresh authenticator, not to one that was moved — another reason Route A is worth the trouble of finding the email password.
Mistakes that actually cost people accounts
- Screenshotting the revocation code. It syncs to a cloud album, and now the last line of defence for the account lives in whatever service that is.
- Sending a maFile to anyone. See above. There is no situation where this is the right move.
- Assuming the old phone still guards the account after a transfer. It does not. Wipe it knowing that.
- Waiting until the phone is broken. Do the transfer while both devices are in your hands and working. Every route gets worse once one of them is gone.
Questions people actually ask
Do I need the old phone?
No. You need the account's email. The old phone is convenient but not required.
The email never arrives.
Check spam first. Then check which address is on the account — Steam sends to the address on file, which is often not the one you use today. If you genuinely cannot read it, you are on Route C.
I have several accounts. A main, an alt, a couple of bots.
A phone holds exactly one official Steam Mobile authenticator, which is the entire reason people end up with a folder of maFiles and a desktop tool they have to walk over to. AVA holds as many accounts as you want in one list, on your phone and on the desktop, with per-account codes, confirmations and trade offers.
Is any of this against Steam's rules?
The transfer uses the same endpoint the official app uses; it is the supported way to move an authenticator. AVA itself is an unofficial community project and is not affiliated with Valve or Steam. It is open source under the MIT licence — if you would rather read the code than take that on trust, that is exactly what it is there for.
Does this cost anything?
No. Codes, confirmations, sign-in approval, the transfer, and .maFile import and export are free in every build and always will be. The paid tier unlocks two themes and removes ads. You can also build AVA yourself into a variant with no ad or billing code compiled in at all.
Getting AVA
Android is on Google Play. Windows, Linux and macOS builds, plus a direct APK, are on the download page. Source is on GitHub.