How to Recover 2FA Codes When You Lose Your Phone

Start with the fastest recovery options

Before you panic, check whether you saved backup codes, enrolled a second authenticator device, or enabled another sign-in option such as email verification, passkeys, or a hardware key.

Those methods are usually much faster than contacting support, and they avoid the delays that come with identity verification.

Use the secret key if you still have it

If you saved the original TOTP secret or QR code, you can generate new codes right away on another device. That is often the cleanest recovery path after a phone upgrade or device loss.

A local browser-based generator is especially useful when you are already signed in on desktop and just need to restore the missing code source.

Know when to rotate instead of recover

If the old phone was stolen, compromised, or accessible to someone else, treating the existing secret as untrusted is safer than reusing it forever.

In that case, sign in with a backup method, disable the old authenticator setup, and generate a brand-new secret with fresh backup codes.

Support is the slow path, not the first path

When there are no backup methods left, support may be your only option. Expect the service to ask for identity proof, billing details, recovery emails, or account history before they reset 2FA.

That process is intentionally strict. The same friction that feels annoying during recovery is what protects you from unauthorized resets.

FAQ

Can I recover 2FA without backup codes?

Sometimes. It depends on the service and whether you saved the secret key or have another trusted sign-in method.

Should I disable 2FA if I lose my phone?

Only after you regain secure access. If you suspect theft or compromise, rotate the secret and re-enable 2FA with a new setup as soon as possible.

What is the best way to avoid future lockouts?

Save backup codes, store the TOTP secret securely, and consider keeping a second trusted authenticator device or hardware key.