What happens to your 2FA codes when you lose your phone
By TOTP Authenticator team ·
If you set up a backup or Cloud Sync before you lost your phone, you can get every account back in a few minutes. If you didn’t, the codes are gone. TOTP secrets never leave the device they’re generated on, so there is nothing for us to look up or restore on your behalf. What you can recover, and how long it takes, depends on which of three routes you set up in advance.
This isn’t meant to scare you. It’s how TOTP actually works, and what you can do about it before you need to.
Why there’s no “reset my codes” button
A TOTP code is generated from a secret that was created once, at setup, and stored only on your device (and wherever you’ve explicitly backed it up to). No central server holds a copy of your codes that we can hand back after a support ticket. That’s the point of the format, and it’s also why losing the only copy of a secret means losing the ability to generate that account’s codes. We cannot restore codes without your backup, your Cloud Sync, or your old device.
So what happens next depends on what you did beforehand.
Route 1: an offline backup file (free)
If you’ve ever exported an encrypted backup file, through Share Backup or by saving it to a custom location, restoring on a new phone is the fastest path. Open the app, choose restore, point it at the file, and every account comes back at once, along with names, icons and organization.
One thing to know if you’re on Android: a backup saved to the app’s default location is deleted automatically when you uninstall the app, and it doesn’t show up in ordinary file managers on Android 10 and newer. If you’re planning ahead for a phone switch, use Share Backup or a custom location rather than the default. Share Backup hands the file to another app, so you can email it to yourself, drop it in a notes app, or put it in cloud storage, whichever you trust. A default-location backup only helps you if you never uninstall in between.
Route 2: re-scan each account from your old phone (free)
If you still have the old phone and it still turns on, you can move accounts one at a time without any backup file. That covers a planned upgrade, or a cracked screen that still powers up. Open an account on the old phone, show its QR code, and scan it with the new phone. Repeat for each account.
It’s slower than a full restore if you have a lot of accounts, but it needs nothing set up ahead of time beyond having the old device. That’s also its limit: if the old phone is lost, stolen, or dead, this route isn’t available to you, no matter how recently you used it.
Route 3: Cloud Sync (a one-time purchase, works automatically)
If you’d already turned on Cloud Sync (iCloud on iOS, Google Drive on Android) before you lost your phone, there’s nothing to do at the moment of loss. Your accounts are already sitting in your own cloud account, and signing into the app on a new device pulls them down. Of the three routes, this is the only one that asks nothing of you at the time you lose the phone, because the safety net was already in place.
Cloud Sync is part of a one-time purchase (per platform) that also adds push to the browser extension. See pricing for what that includes. It isn’t required to have a working backup: routes 1 and 2 are free and stay free, permanently. Cloud Sync is for people who’d rather not think about backups at all.
What “recovered” actually means
Whichever route you use, a full restore brings back more than the six-digit codes. It brings back the whole account list: names, issuer icons, any categories you’d organized accounts into, and the algorithm and digit settings each service needs to generate the right code. Both free routes, backup file and per-account re-scan, bring all of that back. Cloud Sync keeps it up to date continuously, so there’s nothing to restore at all, just a sign-in.
One more thing to know: your new phone’s clock has to be roughly correct for restored codes to match what the service expects, since TOTP codes are time-based. If codes look wrong immediately after a restore, check the device clock before assuming something went wrong with the accounts themselves. The app also detects drift and can repair it automatically.
If you have none of the above
This is the honest, unpleasant case: no backup file, no access to the old device, no Cloud Sync turned on. The codes for those accounts cannot be recovered. Your path forward is to go to each service individually, prove your identity through whatever fallback it offers (recovery codes if you saved any, account recovery support, a linked email), disable the old 2FA method, and set up a new one. It’s tedious and it’s service by service. There’s no shortcut, because we genuinely have no copy of your secrets to hand back.
Many services issue one-time recovery codes when you first turn on 2FA, for exactly this situation. If you saved those somewhere at the time, in a password manager or on a printed sheet in a drawer, that’s usually the quickest way back into an individual account without going through full identity verification.
If you’re reading this before it happens to you: that’s the best time to fix it. Turn on Cloud Sync, or at minimum export a backup file somewhere safe, before you need either.
Set it up now
The fastest way to keep future-you out of the “none of the above” case is to walk through it once while your phone is still in your hand. Our moving to a new phone guide covers all three routes in detail, including the step-by-step screens for backup export and Cloud Sync setup.