How to Unlock 2FA When You're Locked Out of Your Account

To unlock 2FA after losing your phone or authenticator app, use one of the backup methods you set up earlier: a saved backup or recovery code, a second trusted device, a security key or passkey, or a backup phone number. If you have none of those, use the service’s official account recovery flow and expect to wait several days while it checks that you are the owner.

There is no universal “unlock” button, and that is the point of two-factor authentication. Below is what works, in the order worth trying, plus the specific paths for the services people get locked out of most. Everything here is based on the providers’ own help pages as of November 2026. Recovery rules change, so check the linked page before you start.

First, figure out what you still have

Most lockouts come down to one missing factor. Before you file anything, check what you still have:

• Your password, but no codes (lost or reset phone, new phone, deleted authenticator app).
• A device that is still signed in, like a laptop, tablet or old phone.
• Saved backup codes, often in a password manager, a printout, or a file in your Downloads folder.
• A backup factor: a second phone number, a hardware security key, or a passkey on another device.
• Access to your recovery email or phone number.

The more of these you have, the faster you’ll get back in. If you have a signed-in device and a backup code, you can be in within minutes. If you have nothing, you are in for a waiting period, and on some services you may not get the account back at all.

The general recovery order

Work through these steps in order. Stop as soon as one works.

1. Look for a “Try another way” or “Other ways to sign in” link on the 2FA prompt. Most services hide the backup options behind it.
2. Use a backup or recovery code. These are single-use codes you were given when you turned 2FA on. On every service we checked, each code works only once, and making a new set cancels the old one.
3. Use another trusted device or factor. That could be a second signed-in phone, a backup number, a security key, or a passkey.
4. Restore your authenticator app from its backup. GitHub’s docs point out that many authenticator apps can back up to the cloud or export keys, so you may be able to restore your codes to a new phone.
5. If you lost your number, get it back. For text-message codes, Google suggests asking your carrier to move your number to a new phone or SIM card.
6. Start the official account recovery process. Do this last. It is slow, and starting it again and again does not speed it up.

Once you’re back in, switch 2FA to a method you can actually reach, and create a fresh set of backup codes right away.

Service-by-service: how to unlock 2FA

Google

Google’s 2-Step Verification help lists several ways in if you lose your main phone: another phone signed in to your account, a second number added to 2-Step Verification, a saved backup code, a security key, or a passkey made on another device. You may also be able to sign in from a computer where you previously ticked “Don’t ask again on this computer.”

If you downloaded backup codes, Google says to search for a file named Backup-codes-username.txt (details here). With no second step at all, you have to go through account recovery. Google says verification can take 3-5 business days. Accounts in the Advanced Protection Program can only recover with a backup security key.

Apple

Apple’s advice is to try a device that is already signed in first, and to try everything else before you start account recovery (Apple Support). If you set up a recovery key, you need that key plus a code sent to your trusted phone number. Apple warns that if you set up a recovery key and then can’t provide it, you will be locked out permanently.

A recovery contact can also give you a six-digit code. They get no access to your account. Without any of these, standard account recovery can take several days or more. Apple says to turn off your other signed-in devices while you wait, and says contacting Apple won’t speed it up.

Microsoft

If you saved Microsoft’s 25-character recovery code, choose “Other ways to sign in.” Then take the “Forgot password?” path, choose “I don’t have any of these,” and enter the code. The code isn’t case-sensitive. Microsoft says you can’t look up an old code, and making a new one cancels the old one. With two-step verification on, security changes take 30 days to take effect.

The account recovery form works best when you fill it in on a device and at a location you normally use. Microsoft allows up to two tries per day. Note that Microsoft says its support agents can’t help you if two-step verification is on and you can’t reach any of your verification methods. Work or school accounts are different: your organization’s IT admin manages those.

GitHub

GitHub accepts recovery codes, passkeys, security keys, a fallback number, and in some cases a verified device, SSH key or personal access token (GitHub Docs). If you know your password but have no codes, you can file a recovery request, which GitHub says can take up to three business days.

GitHub is strict: if every recovery method fails, support will not restore the account, and access is lost for good. You can still unlink your email address from the locked account so you can use it on a new one.

Epic Games (Fortnite)

On Epic’s 2FA prompt, choose “Try another way” and have a code sent to your email (Epic Account Support). Backup codes from when you set up an authenticator app also work. If neither works, use “Trouble signing in?” on the sign-in page or contact Epic Support. Once you’re back in, go to Password & Security to change your 2FA method or replace an old phone number. Epic has also removed SMS 2FA in some countries, so a missing text may be a regional change rather than a problem with your phone.

Some people searching “unlock 2FA” for Fortnite just want to turn it on. Epic requires 2FA for things like gifting and competitive events, and you set it up in Password & Security on the Epic website, not inside the game.

Avoid scams while you’re locked out

Lockouts attract scammers. Nobody legitimate can “bypass” 2FA for you, and no tool or service offers an official shortcut. Use only the recovery links on the provider’s own website. Never give your password, backup codes or verification codes to anyone who contacts you offering help, including people claiming to be support staff in DMs or comments.

How to never get locked out again

Once you’re back in, spend five minutes on this:

1. Save fresh backup codes in a password manager or print them and store them somewhere safe.
2. Add a second factor you keep separately, like a security key, a passkey on another device, or a backup phone number.
3. Turn on cloud backup in your authenticator app if it offers one, so a new phone doesn’t wipe your codes.
4. Check your recovery email and phone number and update them if they’re old.
5. On Apple, think carefully about a recovery key. It improves security, but losing it can mean losing the account for good.

Before you wipe, trade in or reset an old phone, move your authenticator codes to the new one first. That one habit prevents most 2FA lockouts.