Guide

A verification code never arrives

You are past the password step and the six-digit or eight-digit code has not shown up. This page helps you tell a delivery problem apart from a bigger one, and says what each provider can and cannot do.

First: where is the code going?

"The code never arrived" hides several different problems. Before changing anything, identify the destination the provider is using.

• A phone number. Is it your current number, an old number, or a number you no longer control?
• An email address. Is it an inbox you can open right now? Providers may send a reset link or code to a recovery address rather than your main one.
• An authenticator app or passkey prompt. These do not depend on a message arriving; they depend on a device or app you can unlock.
• Another signed-in device. Some providers offer a prompt or a code on a device that is already signed in.

If you cannot tell which destination is in use, do not sign anything out to guess. Sign in on a device you still control if you can, open the account's sign-in or security settings, and read the recovery details there. If you cannot sign in on any device, treat it as the destination problem described below.

If you can reach the destination

1. Use another way in rather than waiting. Look for an onscreen option such as "Try another way", "Other ways to sign in", "Didn't Get a Code?", "Can't get to your devices?", or "Can't use [this phone number]". Apple and Google both document these options at the code step.
2. Use a backup code if you have one. Google, Microsoft, Bitwarden and 1Password all issue backup or recovery codes for exactly this situation. A Google backup code becomes inactive after one use; an old Microsoft recovery code stops working when a new one is generated.
3. Check the obvious filters. Look in spam, junk and bulk folders, and on an iPhone in the Unknown Senders list. Google's own reset help says to check those folders, request the message again, and check every email address that might have been used on the account.
4. Recheck the destination details. A code sent to an old phone number or a stale recovery address will arrive somewhere you are not looking. Where you can still sign in, update those details, and expect a trust delay before the change takes full effect.
5. For an authenticator app, check the clock. Time-based codes depend on the device clock. If a code keeps being rejected as soon as it is entered, the device time may be wrong rather than the code undelivered.

If you cannot reach the destination

If the code is going to a device, number or inbox that is gone, the problem is the destination, not delivery. Providers will not read a code out to you, and support agents cannot bypass the verification step. Work through Your phone was lost, stolen, or replaced to find the right route, and if no method is left, see No recovery methods left for an honest picture of what happens next.

If the destination is not one you recognise — a phone number or inbox you never added — treat it as possible account takeover rather than a delivery problem. Secure the account first: on a device that still has access, change the password and review the recovery details, and do not approve a sign-in prompt you did not start. If you can no longer sign in, use the provider's own account-recovery process and tell it what you observed. The interactive guide has a dedicated path for "I think someone else got into my account".

How long might this take?

Keep two different waits apart. A text message or email should arrive within moments; if it does not, that is a delivery problem, not a provider delay. A recovery request or a security change is deliberately slowed down, sometimes for days, as a security feature rather than a fault. The table below covers the second kind. These are the documented expectations, not promises.