Guide

No recovery methods left

Every code, device and backup you can think of is gone, and the account still will not let you in. This page is deliberately blunt about what can and cannot be done, because the internet is full of false promises about exactly this situation.

Before giving up, check these again

People often have one route left without realising it. Work through this list honestly before concluding that nothing is left.

• A device that is still signed in. An open session or an app that has not been signed out may keep working. Many providers also offer a prompt on a device that is already signed in.
• A recovery contact. Apple and Google both let you nominate someone in advance. If one was set up, that person can help you start recovery, but the setup had to happen while you could still sign in.
• A saved backup or recovery code. Google, Microsoft, Bitwarden and 1Password issue codes for a lost second factor. A code that was never saved usually cannot be recovered later: Microsoft and Bitwarden state they cannot retrieve an existing code, and where a new code can be generated, that must be done while you are still signed in.
• An organisation administrator. A work or school account is usually managed. The administrator may be able to reset access, and must be asked through your organisation, not the provider.
• A family organiser or team administrator. 1Password family organisers and administrators, and Bitwarden emergency contacts or organisation admins, can recover access if that was set up first.
• A hardware security key or a second synced device. A backup key, or a passkey synced through a credential manager, may still work even when the phone is gone.
• An Apple recovery key. Only if you have it. Setting up an Apple recovery key turns off Apple's standard account recovery, and Apple cannot supply the key to you.

Provider by provider

These are the documented realities. They can change, and the provider's own page is always the authority.

If you have already started a provider's recovery process, check that you are not still waiting on it. Look in the inbox and spam folder of the email address you gave the provider: Microsoft documents replying within 24 hours, and Apple sends a confirmation within 72 hours. Starting a second request does not speed up the first.

If the account cannot be recovered

If the provider's process has run its course, the sensible next steps are about limiting the damage rather than getting back in.

1. Protect any other account that reused that password or email. The most important thing is that the same password is not in use somewhere else.
2. Preserve any session or data you still have. If a device is still signed in, do not sign it out. Export or copy anything you need while you still can, if the product offers an export.
3. Tell your contacts what happened. An unrecoverable mailbox or messaging account can be used to impersonate you. A short message to your contacts warning them is worth sending from another account.
4. Create a replacement account carefully. Use a unique password, turn on two-step verification, and add more than one way to get back in. See Prevent getting locked out.
5. Do not reuse an old password on the replacement. An old password may already have appeared in a breach or be reused on another account; choose one you have never used.