Locked out of Gmail on a new phone

The new phone knows the Gmail password and then asks for a code, a prompt, or a key that still lives on the old one. Google lists five ways through that second step. Another phone already signed in to the account. Another phone number you added under 2-Step Verification. A backup code you saved. A hardware security key you added. A passkey you created on another device. Google’s 2-Step Verification troubleshooting page is the list.

If none of those are in your hands, open g.co/recover and enter the Gmail address. Do that from a browser you usually use, on a computer or phone you have signed in with before, from home or work if you can. Google’s recovery guide says those three details help them recognise you.

The longer checklist is Locked out of your Google or Apple account. If the old phone was stolen, do MFA device lost or broken as well. If someone else changed the password, that is a different incident. Use Gmail account hacked, and how to get it back and Personal email account hacked.

A work, school, or other group account can refuse this whole path. Google says to ask the administrator.

If the old phone still turns on

Move the codes before you erase it, trade it in, or hand it to a shop.

Google Authenticator can keep codes in the Google Account. Google’s Authenticator article says that when you sign in to that Google Account inside the app on the new phone, the codes sync across. You need Authenticator 6.0 or newer on Android, and 4.0 or newer on iOS. Android itself needs to be version 6.0 or newer.

That sync helps the other sites in the app. It does not, by itself, get you into the Google Account if the only second step is the app on the phone you cannot use. Get into the Google Account with a backup code, a passkey, or another signed-in device first. Then open Authenticator on the new phone and sign in.

If you used Authenticator without a Google Account, the codes stay on the old phone. Transfer them by hand.

1. Install Google Authenticator on the new phone.
2. Open it and tap Get Started.
3. Sign in to your Google Account if the screen asks.
4. On the old phone, tap Menu, then Transfer codes, then Export codes. Unlock the phone, select the accounts, and tap Next. Several accounts can mean several QR codes.
5. On the new phone, tap Menu, then Transfer codes, then Import codes, and scan each QR code.

Google says a camera that cannot scan may be looking at too much data. Export fewer accounts and try again.

A newly added authenticator can take up to 7 days before Google offers it at sign-in. A trusted passkey or security key can shorten that wait. Keep the old phone, or another second step, until a real sign-in on the new phone asks for the new app and the code works.

You can also turn on Privacy Screen in the app. Menu, Settings, Privacy Screen. The phone then asks for a PIN, a pattern, or a biometric check before the codes show.

If you have a backup code

Backup codes exist for a lost phone, a new number, or a moment when text, a call, or Authenticator cannot reach you. Google’s backup-code article says you get 10 codes, each one 8 digits, and each code works once. A new set turns the old set off. You cannot download backup codes if the account is in the Advanced Protection Program.

Search the old computer for a file named Backup-codes- plus your username, then .txt. Google’s example is Backup-codes-google123.txt. The file has to have been downloaded onto that computer.

To use one:

1. Sign in to the Google Account with the password.
2. Click Try another way.
3. Click Enter one of your 8-digit backup codes.
4. Enter one unused code.

Mark that code as used. Google never asks for a backup code anywhere except the sign-in screen.

If another device is still signed in

A laptop, a tablet, or an old phone that is still in the account is the fast path. Google can send a prompt to that device. If the prompt or the code is one you cannot reach, the recovery guide says to choose Try again, or I don’t have my phone, and continue.

A passkey on another device works the same way, as a second step. If sign-in never offers the passkey, Google says to check two things. The device that holds the passkey needs its screen lock turned on. The setting Skip password when possible needs to be on at myaccount.google.com/security. Tap Try another way to leave the passkey challenge and see the other choices.

A text to a backup number can fail when the sign-in looks different, including a new location. Google says you may need to be on the main phone, or another trusted device, before that backup number will accept a sign-in. Only the newest text code works if you requested several.

If you used a security key

A second key, backup codes, Google prompts, verification codes, or a computer you told Google not to challenge can still get you in. Then remove the lost key and add a new one. Google’s note on Advanced Protection is stricter. With Advanced Protection, a backup security key is the only second step. Without that backup key, you go through account recovery.

Google says that when you have no other second step, or you also forgot the password, proving it is your account can take 3 to 5 business days. They ask for an email or a phone where they can reach you, then a code sent there.

When none of the second steps are left

Open g.co/recover.

1. Enter the Gmail address. If you are unsure of the address, Google also has a username recovery that needs a phone number or the recovery email, plus the full name on the account.
2. Answer the questions with what you remember. An old password you half remember is useful. Google says a wrong guess does not throw you out, and there is no cap on attempts.
3. If a prompt or a code goes somewhere you cannot open, choose Try again or I don’t have my phone.
4. When you get in, set a password you have never used on this account.

A few limits are worth knowing before you keep refreshing the page.

You cannot add a recovery phone or a recovery email while you are locked out. Google’s recovery-options page says that plainly. If you changed recovery info recently and recovery fails, wait. Google says a change can take up to 7 days to take effect, and to try again after a few days. During those 7 days they may still send codes to the previous phone or email.

Do not use a Google Voice number as the recovery phone once you are back in. The verification text would go to Voice, and Voice needs the Google Account you are locked out of.

You cannot phone Google and ask to be signed in. Google says they do not work with any service that offers account or password recovery. Anyone selling that is asking for the password or the codes. Do not hand them over. Google also says they never ask for a password or a verification code by email, phone call, or message.

If this Gmail belongs to a child under 13, or the age that applies in your country, Google says a parent can reset the child’s password. The steps above are for your own account.

After the new phone is signed in

Do this while you still remember how you got in.

1. Open myaccount.google.com, then Security & sign-in.
2. Under How you sign in to Google, open Recovery phone. Add a mobile number that receives texts, that only you use, and that you keep with you. Skip Google Voice.
3. Open Recovery email and add an address you read. Use a different address from this Gmail login.
4. Open 2-Step Verification, then Backup codes, then Continue. Download or print the 10 codes. Keep the paper with the documents you would grab in a fire. Refreshing the list kills the previous codes, so print the new sheet and throw the old one away.
5. Sign in to Google Authenticator with this Google Account so the next phone gets the codes without a QR scan.
6. If the old phone is lost or stolen, sign it out and change the Google password. That pair of steps is Google’s own advice for a missing phone. The settings for a stolen handset are in What to do if your phone is stolen.

A recovery contact is optional. You send them a request from Security & sign-in, then Recovery contacts. The request lasts 7 days. After they accept, Google waits another 7 days before you can use them to get back in. They do not receive your security alerts.

If the inbox was used by someone else while you were out, cleaning the password is only the start. Forwarding rules and connected apps survive it. That cleanup is Personal email account hacked. The phone-change version of the same lock, including what to store before the next handset, is Locked out of your Google or Apple account.

Related playbooks

• Locked out of your Google or Apple account. Nobody attacked you. You simply cannot get back into the account that holds your photos, your email, and your two-factor codes.
• MFA device lost or broken. The phone or security key used to approve critical logins is unavailable, damaged, or stolen.
• Personal email account hacked. Someone else is in your email, which means they can reset the password on almost everything else you own.