Stillcode › Two-factor authentication › Lost phone
When the phone holding your codes is gone
Your authenticator codes live on one device, and no service can send you a replacement. Here is what that actually means, and the two-minute check that makes it survivable — which only works while the phone still works.
The situation, stated plainly
If the secret exists on one device only, and that device is lost, stolen, wiped, dropped or simply traded in, the codes are gone with it. Not recoverable from the service, because the service never had a way to send them to you — see how the codes work.
Everything that follows is a consequence of that one sentence. There is no trick and no support line that undoes it; there is only what you arranged beforehand.
⭐ The two-minute check, today
Not after something happens. While the phone still works:
- Find your recovery codes for the two or three accounts you cannot afford to lose. Not "I think I saved them" — open the place they should be. If you cannot find them in two minutes, you do not have them. Generate a fresh set from that service's security settings, which invalidates the old ones.
- Count the devices your codes exist on. If the answer is one, one accident is all it takes.
- Check the mailbox you would recover through. Account recovery almost always runs through email, so a mailbox protected more weakly than the account is the real setting — and it is the account to fix first.
If it has already happened
In rough order of how well they work:
| Route | What it needs |
|---|---|
| A recovery code | That you saved them. Each is single-use; one is enough to get in and set up a new authenticator |
| A second device already holding the codes | That you set it up in advance — a tablet, a second phone, or a synced authenticator |
| Another enrolled factor | A hardware key, or an SMS number you still control. Worth checking per service: several accept more than one |
| A session that is still signed in | ⭐ Often overlooked and often decisive — a browser or app still logged in can usually reach the security settings and enrol a new device |
| Account recovery | Proving who you are to support, on their timetable. Days to never, and the outcome recovery codes exist to avoid |
⚠️ Do the "still signed in" check first and fast. Sessions expire, and a live one is the cheapest route on this table.
What actually prevents it
Two things, and they are not the same thing:
- Recovery codes, saved somewhere you will find them. A password manager, a printed sheet, anywhere that is not the phone itself. These get you back into the account.
- The codes existing on more than one device. This is the one that means you never lose access in the first place, rather than recovering from having lost it.
⛔ Neither is free of trade-offs, and anyone telling you otherwise is selling something. A second copy of a secret is a second place it can be taken from. That is a real cost, and it is usually the right trade — losing everything is a worse outcome than a slightly larger surface, for almost everyone.
Where Stillcode fits, honestly
Stillcode is an iPhone, iPad and Mac authenticator that makes no network calls at all. Unlimited accounts, bulk import, search and the Face ID lock are free — and adding accounts is free, so an unpaid install is a perfectly good authenticator.
Being on a second device is not free, and this page is the wrong place to be vague about it. iCloud Keychain sync, the encrypted export file, and restoring from one are all Stillcode Pro — sold monthly, yearly or as a single payment, at the price the App Store shows for your country.
⭐ The free route out is the per-account migration QR. Each account can show its
own QR on screen, in the standard otpauth:// shape any authenticator reads, so you can
move accounts to a second app one at a time without paying. It writes no file and touches no
network. ⚠️ It is a way to move, not a backup — and like everything else on this page it
only works while the phone still does.
Get Stillcode on the App Store
Requires iOS 15.1 or later.
The nine that publish a page for this
Of the fifty services here, nine publish a page about not being able to complete two-factor sign-in. The other forty-one leave you with ordinary account recovery — proving who you are to support, on their timetable. If you hold one of these nine, its page is worth reading before you need it:
For the rest: all fifty services.