Lost a phone with your authenticator? Start with what you still have

If another working authenticator still exists

Start by identifying which accounts you must access and whether any other trusted device can still produce valid codes. You may already have a second authenticator enrollment, a securely stored encrypted Vault, or another factor accepted by the original service. Test the working factor on a legitimate site before changing anything. Do not delete a functioning entry simply because a lost phone might also contain a copy.

For accounts that have sensitive administrative access, use the original service's security settings to review active sessions and registered authenticators. A stolen phone is also a device security incident: follow its operating system provider's account and remote-device security guidance, change relevant credentials if exposure is suspected, and review account activity. Avoid relying on an authenticator's rotating code as proof that the physical phone was never compromised.

If you can still sign in to the 2FASync member account

A matching 2FASync Vault passphrase or recovery key may allow the browser to open the member's encrypted credentials after Google account authentication. Google sign-in identifies the member account; it does not substitute for the Vault encryption material. A newly registered browser may also need device/session binding before encrypted items are available. Treat an unavailable-device or locked-Vault message as a specific state, not a suggestion to overwrite the Vault.

If you still have Google account access but have forgotten the Vault passphrase, look for your separately saved Vault recovery key. If you have lost both unlock paths and no compatible encrypted backup, the server is not designed to reconstruct the plaintext TOTP secrets from stored ciphertext. An email address, a familiar account label, or support request cannot make an absent key reappear.

If Google access is lost but an encrypted backup exists

A previously downloaded compatible 2FASync encrypted backup can be opened in the local restore flow using its matching recovery key. That path is intentionally distinct from Google member login, so it can be useful when the original Google account or cloud service is unavailable. Open the file only in a browser you trust, verify the local preview, and use the recovered codes on the original websites where appropriate.

This does not itself restore your Google identity or unlock a different member's encrypted cloud Vault. If you later create or regain a member account, any transfer from the local backup to a destination Vault requires its own explicit encrypted import and sync confirmation. Never upload the decrypted backup or recovery key to an external website that promises instant restoration.

If no seed or backup survived, ask the original service

A TOTP number is derived from a secret. Without the secret or a surviving authenticator copy, a code generator has no information from which to reconstruct it. Search for the one-time recovery codes that the original service offered when you enrolled two-factor authentication. Check whether you have a registered passkey, security key, alternate verified factor, or an active session through which that provider permits re-enrollment.

If none of those routes exists, use the original account provider's official recovery process. Its identity checks and recovery decisions are outside 2FASync's control. A person offering to recreate a missing authenticator from the service name, username, or email address alone should be treated with suspicion, especially if they ask for passwords, OTPs, or identity documents through unofficial channels.

After recovery, reduce the chance of a repeat

Once access is regained, review and remove unused authenticator enrollments at each source website, particularly any setup keys possibly copied from the missing phone. Create a current encrypted backup if the member Vault workflow is approved and ready, store its matching recovery key separately, and retain official account recovery codes where applicable. Verify at least one alternate sign-in factor before deactivating the only working one.

Document your recovery inventory without writing down live OTP values or raw QR payloads in an unsecured note. Useful non-secret records include which services use TOTP, where you stored their official backup codes, which encrypted backup generation you tested, and how you will reach those stores after a device loss.

Can 2FASync recover a TOTP seed from my email address?

No. A lost seed cannot be regenerated from an email address or service label. You need a working authenticator copy, correct encrypted recovery material, or the original service's recovery process.

Is a website's backup code the same as my Vault recovery key?

No. Website backup codes recover access to that website. A 2FASync Vault recovery key unlocks matching encrypted Vault or backup material.