Losing access to your two-factor authentication method is one of the most stressful account situations to be in. Whether your phone was lost or stolen, your authenticator app was accidentally deleted, or you simply cannot remember where you saved your backup codes — there are recovery paths for most platforms. This guide covers exactly what to do on each major service.
Before You Start: Check These First
Before going through account recovery, check these quick options:
- Backup codes — Did you save these when you first set up 2FA? Check your password manager, notes app, email, or any printed sheets you might have stored.
- Trusted device — Are you still signed in on another device (laptop, tablet, old phone)? Many platforms let you access security settings from a trusted device without a 2FA code.
- Cloud-synced authenticator — If you used Authy, Google Authenticator with Google Account sync, or Microsoft Authenticator with backup enabled, install the app on a new device and restore from the backup.
- Recovery email or phone — Some platforms let you verify via your registered recovery email or phone number instead of your 2FA code.
Google Account
Go to accounts.google.com/signin/recovery. Google offers multiple fallbacks: verification to your recovery email or phone number, approval from a trusted device already signed in, or answering questions about your account. The more account history Google has for you, the smoother the recovery. Once recovered, go to Security → 2-Step Verification → Turn off, then re-enrol with a new setup.
Apple ID
Visit iforgot.apple.com. If you have a trusted phone number set up, Apple can send a code to that number. If you have a trusted Apple device (iPhone, Mac, iPad), you can approve the recovery from that device. If neither is available, Apple initiates Account Recovery — a waiting period to verify your identity. This can take several days. An Account Recovery Contact set up in advance can significantly speed up this process.
Microsoft / Xbox Account
Go to account.live.com/acsr. Microsoft's account recovery form walks you through identity verification using information about your account history — email addresses previously associated with the account, recent purchases, frequently used locations, and more. If successful, you regain access immediately. Once in, go to Security → Advanced security options → Two-step verification → Turn off.
Facebook and Instagram
On the login screen, click Get more help or Having trouble logging in?. Facebook offers identity recovery via government ID submission. This typically takes 1–3 business days. Instagram follows the same process through its support flow. Once access is restored, you can disable 2FA from your security settings and re-enrol with a fresh setup.
GitHub
GitHub has one of the strictest recovery policies. Use a saved backup code — this is the primary fallback. If you have an SSH key or personal access token, you can access the API to attempt recovery. If you have no backup codes and no alternative verification method, GitHub's account recovery requires verifying your identity through the support team, which may not always be successful. This is why GitHub explicitly warns users to save backup codes.
Twitter / X
Click Trouble logging in? on the sign-in page. X offers recovery via your registered email address or phone number. If those are accessible, you can receive a reset link. If your account email is also inaccessible, use the account recovery form and verify your identity through X support.
After Recovering Access
Once you regain access to your account, do these things immediately: change your password in case the lockout was related to a security incident, then re-enrol 2FA from scratch. This time, do the following properly: save your backup codes in a password manager, use an authenticator app with cloud backup enabled (Authy or Google Authenticator with Google Account sync), and add a recovery email and phone number as fallbacks. Losing 2FA access once is enough — a few minutes of preparation prevents it from ever happening again.