Lost your phone? How to get your authenticator codes back

Published 21 September 2026. About 7 minutes.

If your phone is gone and your authenticator was on it, start here. The short version: your codes are not gone if you had sync or a backup, and if you had neither, you are not locked out either — you go through each service's own account recovery instead, which is slower but survivable. Nothing below requires you to be a KeyNesta user.

If the phone is still in your hand and the app is simply producing codes the service rejects, that is a different problem with a different fix: 2FA code not working works through the causes in order, starting with the clock.

If the phone is still in your hand and it is the app that is gone, this page is more than you need: start with what a reinstall actually brings back, which differs by app, and which names the moves that quietly destroy a recovery you still have.

First, what is actually lost

Authenticator codes are generated from a secret stored on the device, not from a server. Losing the device means losing those secrets unless a copy exists somewhere else. It does not mean anyone can use them: on a phone with a lock screen, an attacker needs to get past that, and in KeyNesta's case past the vault passphrase as well. The urgent problem is your own access, not, in most cases, someone else's.

Work out which of three situations you are in, because the rest of this page splits there.

1. You had encrypted sync turned on

This is the five-minute case. On any other device, open the KeyNesta web app or install the mobile app, sign in to your sync account, and enter your vault passphrase. Your spaces, groups, tags and every entry come back, because what the server held was ciphertext that your passphrase — and only your passphrase — unwraps.

Then do one more thing while you are in there: open your device list and revoke the lost phone. Revocation takes effect at that device's next request rather than its next login, so it stops syncing immediately.

2. You had an encrypted backup file

Also quick. Open the web app, choose to restore a backup, select the file, and enter the password you set when you made it. The vault is rebuilt exactly as it was at the moment the backup was taken — which is the catch worth naming: any account you added after that backup is not in it, and falls into situation 3 below.

3. You had neither

Then the codes themselves are unrecoverable, and no authenticator app can honestly tell you otherwise. What you recover instead is each account, one at a time, through the service that issued the code. In rough order of how well it tends to work:

• Backup or recovery codes. The one-time codes a service showed you when you enabled 2FA, which most people save and forget about. Check your password manager, your downloads folder, printouts, and any file called something like recovery-codes.txt. Each one works once, and what happens after you spend one is worth reading before you do.
• A second factor you still have. Many services allow more than one: a security key, a second authenticator, a trusted device that is still signed in, or an SMS fallback. Try the still-signed-in device first — an active session is often enough to add a new authenticator without a full recovery.
• The provider's account recovery. Identity checks, waiting periods, and sometimes a support ticket. Expect days rather than minutes for financial services, and have the account details they will ask for ready.

Do the important accounts first: your primary email, because it is the recovery path for most of the others, then anything financial, then your registrar and cloud provider if you run infrastructure. As each one comes back, add it to a fresh authenticator and save the new recovery codes properly this time.

What KeyNesta cannot do for you

We cannot restore a vault whose passphrase you have forgotten, and we cannot read a backup file whose password is lost. That is not a support policy that can be escalated: the server stores ciphertext and no key that opens it, which is the same property that makes a breach of our servers uninteresting to an attacker. The cost of that design is paid on exactly this page, and pretending otherwise would be the more dishonest option.

So this never happens again

1. Turn on encrypted sync, or make an encrypted backup file today and store it where you store important documents. Either one turns a lost phone into a ten-minute inconvenience.
2. Write down your vault passphrase and keep it somewhere physical, or in a password manager you can reach without the lost phone. A passphrase you only ever typed on the device that is gone is not a passphrase you have.
3. Save the recovery codes every service offers when you enable 2FA, somewhere that is neither this phone nor the password entry for that same account — a code plus the password is a complete login. Where to store your 2FA backup codes ranks the options and covers regenerating a set you never saved.
4. Keep a second device unlocked into the vault — a laptop browser counts. Two devices is the difference between a problem and an emergency.
5. Check the backup is real. Restore it once, into a spare vault, and confirm the codes match. An untested backup is a belief, not a backup.

The mechanics of all five, in order: 2FA backup and sync. Planning a switch rather than recovering from one? Moving your authenticator to a new phone covers Google Authenticator, Microsoft Authenticator, Authy, 2FAS, Aegis, and the 2FA setup guides show where each service keeps its recovery codes: Google, Microsoft, GitHub, AWS, Amazon, Facebook, Instagram, X, Discord, Dropbox, Coinbase, PayPal, LinkedIn, Reddit.

Frequently asked questions