Everything here is general guidance, not professional advice. We research carefully and can still be wrong or out of date, so treat it as suggestions to check rather than instructions to follow, and accept that you act on it at your own risk. Full terms.

Disaster Lab
BlogLost your authenticator app, what to do

Lost your authenticator app, what to do

If the old phone still turns on, move the authenticator codes before you erase it. If the phone is gone, use a backup code or a second factor you already saved, one account at a time, starting with email.

The authenticator app is a stack of one-time codes, and each code belongs to one site. Losing the phone does not lock every account in the same way. An account with a backup code, a passkey, a security key, or a browser that is still signed in can still be opened. An account whose only second factor was that app needs the backup you saved, or that site’s own recovery.

If the old phone still turns on, move the codes before you erase it. If it is already gone, recover one account at a time, starting with email and the password manager. The checklist for a missing second factor is MFA device lost or broken. The sign-in around a Google or Apple account is Locked out of your Google or Apple account.

Move Google Authenticator while you still have the phone

Google’s Authenticator article describes two setups.

If you are signed in to your Google Account inside the app, the codes are stored with that account. Install Authenticator on the new phone, sign in with the same Google Account, and the codes sync. Google asks for Authenticator 6.0 or newer on Android, and 4.0 or newer on iOS.

Signing in to that Google Account can itself ask for a code from the old phone. Use a backup code, a passkey, another signed-in device, or the old phone once, so the new phone can sign in and receive the sync. The click path for a Google Account that will not accept the new phone is Locked out of Gmail on a new phone.

If you chose Use without an account, nothing is in the cloud. Transfer from the old phone.

  1. Install Google Authenticator on the new phone, tap Get Started, and sign in if it asks.
  2. On the old phone, tap Menu, then Transfer codes, then Export codes. Unlock the phone, select the accounts, and tap Next. A long list can produce more than one QR code.
  3. On the new phone, tap Menu, then Transfer codes, then Import codes, and scan each code.

Keep the old phone until you have signed in to one important site with a code from the new phone. A code that fails is often the phone clock. Google says to check that you typed it before it expired, that you picked the right account, and that the phone’s time is correct for your time zone. The in-app time-correction setting was removed in Authenticator 7.0. The app uses the phone’s clock.

Deleting a synced code deletes it on every device that syncs that Google Account. Swipe with care.

Move Microsoft Authenticator while you still have the phone

Microsoft Authenticator backs up one-time codes only if you turned backup on. Microsoft’s backup article says an iOS backup cannot be restored on an Android phone, and the reverse is also true. Work or school accounts are not in the backup. You get the account name back, then you sign in and register the account again on the new phone. Keep the old phone until that registration works.

What does come back, when backup was on:

  • A Microsoft personal account that uses a 30-second code.
  • A third-party account, such as LinkedIn or Facebook, that uses a 30-second code.

A Microsoft personal account that signs in without a password does not put that passwordless credential in the backup. You get the name, then you sign in again.

On Android, until January 2027:

  1. Open Microsoft Authenticator.
  2. Tap the menu, then Settings.
  3. Turn on Cloud Backup.
  4. Select the Microsoft personal account that should hold the backup, then tap OK.

Microsoft’s page says that from January 2027 the Android backup stops using that Microsoft personal account. You turn on Microsoft Authenticator inside Google One backup instead. If you are reading this after that date, use the steps on Microsoft’s page for Google One. If Cloud Backup says “Something went wrong”, Microsoft says you are not signed in. Turn the toggle on and choose Continue or Change account.

A backup saved to the wrong Microsoft account has to be deleted and made again. Settings, Backup, turn Cloud Backup off, confirm, then turn it on and pick the right account.

On iPhone:

  1. Turn on iCloud Drive, iCloud Keychain, and iCloud Backup.
  2. Open the Saved to iCloud list and turn on Authenticator.
  3. Open the Authenticator app at least once before you switch phones. Microsoft also says to be on version 6.8.33 or later if a restore does not appear.

On the new phone, install Authenticator and choose Restore from backup before you sign in. Microsoft’s restore article says that if you already signed in, sign out, then use Restore from backup or Begin recovery. If you do not see those links, sign out of every account in the app and try again. iPhone restore problems that are really iCloud problems go to Apple. Android restore problems that are really the Microsoft backup account go to the Microsoft sign-in helper. Microsoft says their support agents cannot restore the backup for you.

When the phone is already gone

Open the accounts you can still reach, add a new second factor, and only then remove the lost phone from that account. Turning two-factor authentication off, and leaving it off, is how the next person walks in.

Start with email, then the password manager, then the bank and the shops. A backup code printed on paper or saved in the password manager is the normal second step. Google’s codes are 8 digits, one use each. Search an old computer for Backup-codes- plus the username and .txt.

For the Google Account itself, Google lists another signed-in phone, another number you added under 2-Step Verification, a saved backup code, a hardware security key, and a passkey on another device. Advanced Protection accepts only a backup security key. The recovery page, when those are gone, is g.co/recover. You cannot call Google and ask to be signed in.

For a personal Microsoft account, a second contact method still works. Microsoft’s two-step verification article says that if you lose the only contact method, the password alone will not get you in. It can take 30 days, and you may lose the account. The recovery form at account.live.com/acsr says that if two-step verification is on, you cannot recover the account that way. Support agents are not allowed to send a reset link. The full Outlook and Hotmail path is Outlook or Hotmail account hacked, what to do.

Other sites follow the same shape, with their own page. GitHub is a clear example because they publish the limit.

GitHub’s lost-2FA article says support will not restore an account that has two-factor authentication if you have also lost the recovery methods. A recovery code still gets you in.

  1. Go to github.com/login.
  2. Enter the username and password. If you linked a social login, that works in place of the password.
  3. Under More options, click 2FA recovery code.
  4. Enter one code and click Verify.

Each code looks like xxxxx-yyyyy. The downloaded file is usually github-recovery-codes.txt. A code that was already used, or a set from before you turned two-factor authentication off and on again, will fail. Generating a new set also retires the old one.

A passkey on the account satisfies both the password and the second factor. A security key you already registered works as the second factor.

If you know the password and you have no code, GitHub’s longer recovery is:

  1. Sign in until the two-factor prompt.
  2. Under More options, click 2FA recovery code, then Begin account or email recovery.
  3. Click I understand, get started.
  4. Send the one-time password to the email addresses on the account, and enter it.
  5. Verify with this device, if you have signed in here before, or with an SSH key, or with a personal access token.

GitHub says a factor you used before can still be unavailable. SSH keys are removed after a period of inactivity. They do not print the number of days on that page. A person at GitHub Support reviews the request and emails you within three business days. You can still use a recovery code during that wait. If you also forgot the password, start at github.com/password_reset. The reset email link lasts 3 hours, and only a primary or backup email can request it.

If every GitHub recovery method is gone, you have lost the account. GitHub lets you unlink the email so you can use that address on a new account. That is their page, not a bypass.

Pay nobody who offers to remove two-factor authentication for a fee. Google says they do not work with account-recovery services, and they never ask for a backup code except on the sign-in screen. The same caution fits every other site. Use the recovery page on the company’s own site.

If the phone was stolen

Lock the handset before you erase it. The settings, for iPhone and Android, are in What to do if your phone is stolen and in Phone lost or stolen. A locked screen stops someone opening the authenticator. It does not, by itself, remove a code that is still registered on your accounts.

Google’s Authenticator article says to remote-erase a lost or stolen phone so the codes on it cannot be used. Do that erase after you have another way into the accounts whose codes were only on that phone. An erase deletes unsynced codes you have not copied, and the stolen-phone guide explains why Apple and Google also want you to try the lock and the location first.

If the Google Authenticator codes were synced to your Google Account, Google says you can remove them by removing that device from the Google Account. If they were not synced, you sign in to each site another way, remove the lost authenticator, and add the new phone.

On a Microsoft account, remove the lost phone from security info once you are in. Recent activity shows Identity verification app added and Identity verification app deleted. An add you did not do means someone registered their own app.

A stolen phone can also mean a stolen number, if the SIM moved. Texts that reset your email would follow the number. That case is SIM swap, what to do.

After each account is open

Remove the lost phone from that account’s two-factor list. Add a new authenticator, and add a second method that is not the same phone. Print new backup codes and keep them with your documents. Google gives you 10 codes, and creating a new set turns the old set off. Microsoft recommends three pieces of security info on the account, because one lost phone should not be the end of the login.

A work or school account is registered again by signing in on the new phone. The backup will not carry those credentials over.

When email is back, and the password manager opens, the remaining sites go faster because the backup codes are usually in one of those two places. The prepare list for the next lost phone is MFA device lost or broken.

  • MFA device lost or broken. The phone or security key used to approve critical logins is unavailable, damaged, or stolen.
  • Locked out of your Google or Apple account. Nobody attacked you. You simply cannot get back into the account that holds your photos, your email, and your two-factor codes.
  • Phone lost or stolen. Your phone is gone, and it is signed in to your email, your bank, your messages, and the codes that protect everything else.

Questions

Does losing the authenticator lock every account at once?

Each code belongs to one account. A backup code, a passkey, a security key, or a browser that is still signed in can open that account. Google Authenticator can also sync codes through your Google Account. Microsoft Authenticator can restore them only if you turned backup on, and only onto the same kind of phone.

I still have the old phone. What do I tap before I wipe it?

In Google Authenticator, sign in with your Google Account on the new phone so synced codes arrive, or use Transfer codes to export a QR code from the old phone and import it on the new one. In Microsoft Authenticator, turn on Cloud Backup on Android or the iCloud backup on iPhone, then restore on a new phone of the same type.

The phone is already gone and I have no backup codes. Can the app company restore them?

Google and Microsoft restore only what you already backed up. GitHub says support will not restore a two-factor account if you have also lost the recovery methods. Microsoft says that if two-step verification is on and you have lost the only contact method, the password alone will not get you in.

The phone was stolen. Do I erase it now?

Lock it first, with the steps in the stolen-phone guide. Erase it after you have another way into the accounts whose codes lived only on that phone. An erase also deletes unsynced authenticator codes you have not copied.